Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Broken Link Hijacking #277

Merged
merged 2 commits into from
Apr 23, 2020
Merged

Add Broken Link Hijacking #277

merged 2 commits into from
Apr 23, 2020

Conversation

plr0man
Copy link
Contributor

@plr0man plr0man commented Mar 3, 2020

Issue: Resolves #274

CVSS v3 Mapping:

server_side_injection.content_spoofing.impersonation_via_broken_link_hijacking: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CWE Mapping:

Updated parent node - server_side_injection.content_spoofing: CWE-451

Remediation Advice Mapping:

In order to prevent this type of injection consider the following solutions:

  1. Keep track of company's public 3rd party accounts, that includes social media. Whenever one is deleted, make sure it is not referenced in the application
  2. Monitor all hyperlinks pointing to 3rd party resources, as well as any other external references for that matter, and make sure that they do not become invalid, e.g. check for change in HTTP response code. In many cases it may be possible for anyone to claim such URL's and share new content.
  3. Always treat all user input as untrusted data.

Checklist:

  • I have added entries to CHANGELOG.md and marked it Added/Changed/Removed

@plr0man plr0man added this to the v1.9 milestone Mar 3, 2020
@adamrdavid adamrdavid merged commit 897fbb0 into master Apr 23, 2020
@adamrdavid adamrdavid deleted the add-social-media-acctakeover branch April 23, 2020 19:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Development

Successfully merging this pull request may close these issues.

Adding a category for Social Media Account takeovers
4 participants