3 ms·
It is beyond unprofessional, it's down right dangerous. Obviously the guy is not a security researcher so he's probably not aware of proper disclosure protocol
by MichaelAza 13y ago
It is beyond unprofessional, it's down right dangerous.
Obviously the guy is not a security researcher so he's probably not aware of proper disclosure protocol but seeing as he's fully aware this bug is exploitable ("Step 8. REALIZE I CAN CRASH 99% OF ALL WEB 3.9 SHIT-TASTIC WEBSCALE MONGO-DEPLOYING SERVICES WITH 16 BYTE POST") doing it this way is really not excusable, no matter how pissed you are.
- sp332 13y agoAnyone looking for this vulnerability could run a static analyzer on the MongoDB codebase and they would have found this bug already.
- MichaelAza 13y agoThink of it this way - a professional might have done what you're suggesting. Now, any script kiddie can exploit it.