URL redirect bug about stacker.news HOT 4 CLOSED

Thanks for posting! I actually didn't see the SN post but saw this ticket here.
So thank you very much, I guess we would have totally missed it otherwise.

This is definitely an issue and we should warn users before redirecting them to external sites like many other sites do.

For example, clicking on this link shows a prompt before redirecting: https://www.google.com/url?q=https://www.bufferzonesecurity.com :

More info about open redirects here: https://bufferzonesecurity.com/open-redirection-what-is-this-phishing-technique-and-how-do-i-defend-against-it/

Therefore, an attacker could just create a very similar site that looks like SN to grab credentials from users who don't check the URL again. So I agree, this is indeed severe.

Fortunately, the fix should be easy by just validating the callback URL. Will create a PR in a few minutes.

from stacker.news.

Alright fix deployed. Thank you everyone. I'll send you all some sats today.

from stacker.news.

Taking a more closer look, I realized that grabbing of credentials wasn't possible.

No login or signup method uses passwords on SN.

For example, using Lightning for authentication, a different pubkey would have been created since the domain name is included during key derivation.
I assume similar is true for Slashtags authentication.

Using Github and Twitter, a third-party authenticates the user.

With E-Mail, a link is sent to the address for signup and login.

So afaik, there was no possibility to grab user credentials and steal funds using this exploit. Users can't enter a password on a phishing site if they have none.

@huumn, @ShellInjector, @orthzar, do you come to the same conclusion?

But of course still thanks for creating this ticket! I think this was still a severe issue which may be used for other malicious stuff. We should definitely warn users when they leave SN when it's unexpected.

from stacker.news.

Sure! there was no possibility to perform such advanced attacks , but if someone manage to escalate the issue to Cross site scripting or so . maybe there will be a scenario stealing Cookies or Interesting headers .

from stacker.news.