4 ms·
GoDaddy CSRF Vulnerability Allows Domain Takeover
- ireflect 12y agoGood find and nice writeup, but this disclosure timeline is pretty harsh! > 01/17/15 [Saturday] Initial discovery and attempt to reach GoDaddy security. > 01/18/15 [Sunday] Further attempts to reach GoDaddy security, finally received word there was no timeline for a fix. That GoDaddy acknowledged the issue after only a day (over a weekend, no less) is impressive. Surely they deserve another few days to figure out a timeline for a fix.
- xordon 12y ago> 1/19/15 [Monday] GoDaddy implemented CSRF protection for sensitive account actions.
- bdonlan 12y agoYeah, it's totally reasonable that they won't have a timeline the day they got the report. And if they fix it the next day, who cares that they didn't give an ETA? Clearly they had better things to do than reporting back.
- Joona 12y agoReddit discussion: https://www.reddit.com/r/netsec/comments/2sz6n0/godaddy_csrf_vulnerability_allows_domain_takeover/ https://www.reddit.com/r/netsec/comments/2sz6n0/godaddy_csrf...
- crivabene 12y agoI wonder if this vulnerability is in some way related to the Gigya.com domain takeover by the SEA happened in November.