HexBrain

Gratipay · Report #116618

proxy port 7000 and shell port 514 not filtered

Informativestatus
20 Feb 2016disclosed

How it was found

port 7000 on assets.gratipay.com was found to be open to the public. The port seems to be working on a proxy module of nginx and i was able to connect to ot by configuring my browser to use it as a proxy.

also port 514 is also found to be open and connection to it via rlogin succeeds although no substantial data is revealed.

These ports may reveal internal architecture of application and can be use to communicate to internal d=network of the server, hence should be filtered from direct interation

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original