Tag Info

New answers tagged

6

I would inform the individual responsible for the site and data immediately. Having that in email or written form for evidence would be a good idea. Within the communication I would reference OWASP's TOP 10 that specifically highlights the dangers of SQL injection. Unless you have evidence that the site has been / is compromised I would not say that but I ...


6

They have experienced attacks, they just don't know it. You should tell them: Assume that all data in the site has been compromised. Tell them what you told us: The site needs to be re-written.


1

I would recommend that you obtain documentation and demonstration of the vulnerability as you are aware of it. Ideally if you can have this verified entirely by a third party, who has been read in to the situation. To avoid issues of integrity or vendor repudiation of the advice on the vulnerability against you, additional proof by demonstration/execution ...


3

Ryan Sleevi has very good advice regarding this. Before sounding off too many alarms, I would contact the Chromium Security Team as he has advised, just to make sure that you are not misunderstanding anything. Have you checked your vulnerability against the CAB Forum Baseline Requirements to see if the execution of your vulnerability breaks those rules: ...


0

Operating system and browser vendors might be a good place to report such a vulnerability to since they manage the root CA lists. Here are a few relevant links: www.google.com/about/appsecurity/ www.mozilla.org/en-US/about/governance/policies/security-group/bugs/ www.apple.com/support/security/ technet.microsoft.com/en-us/security/ff852094.aspx


18

When unsure, you can also contact CERT: https://forms.cert.org/VulReport/ They have experience in dealing with even very serious security vulnerabilities, and are generally considered a trusted party. At least they can confirm that your assessment of the vulnerability is correct, and document your part in finding it. While CERT generally advises you to ...


33

Such a claim is generally quite serious. While reaching out to the vendor in question is a responsible matter, you should certainly consider notifying the relevant root store security teams, since they are responsible for designing, evaluating, and applying the security controls to prevent this, and will likely need to directly work with the CA to ascertain ...


23

Congratulations! Sounds like a major find. First, generate some proof. The github.com SSL certificate sounds like a great start. Make sure you keep all the network traces you need to show exactly what happened. You need to determine if you broke any laws or T&Cs while doing this. If the CA does not have a bug bounty, you almost certainly did. In that ...


64

It sounds like your issue is that this vulnerability is bigger than you know what to do with. The rules of responsible disclosure, as decribed here, say that you should contact the vendor and negotiate a period of time - between 1 week and 6 months, depending on the depth of the changes required - in which they can implement a patch, revoke and re-issue ...



Top 50 recent answers are included