what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

perfact::mpa Insecure Direct Object Reference

Posted Mar 1, 2016

Authored by Matthias Deeg, Sven Freund | Site syss.de

The SySS GmbH found out that any logged in user is able to download valid VPN configuration files of arbitrary existing remote sessions. All an intruder needs to know is the URL with the dynamic parameter "brsessid". Due to the modification of this incremental increasing integer value, it is possible to enumerate and download a valid VPN configuration file for every existing remote session.

tags | exploit, remote, arbitrary

SHA-256 | 0395cba8a67f491b8450abca96173ea16da49abe7cd6b3f2d88cf3e02d04710c

Download | Favorite | View

Related Files

No related files