AMBER AI: Support Portal Takeover via Leaked API KEY
Discription

Thanks @khizer47 for the report. Insecure zendesk API token hardcoded in JS file, causing Support portals to lose control of administrator rights. We removed dangerous token and controlled permissions by using more secure OAuth token.
An API key & associated Email was Hardcoded into a JS file linked on the Homepage of http://www.whalefin.com which gave me full administrator-level access to Amer group Multiple Support Portals and associated Organisations.

This issue was quickly fixed by removing the affected JS file & Updating/Depreciating the Leaked API Key.Read More

Back to Main

Subscribe for the latest news:
Generated by Feedzy
%d bloggers like this: