Ubiquiti Inc. · Report #179986
Exposed API-key allows to control nightly builds of firmwares (█████████ & ████████)
Validstatus
highseverity
21upvotes
9 Oct 2017disclosed
Summary
The researcher found a public API token that was mistakenly granted full-access permission, which allowed the creation/overwrite of nightly builds of UniFi Firmware.
Publicly available api-key granted full access permissions to API that controls nightly builds of Ubiquiti firmwares, i.e. it was possible to upload new builds and modify existing ones.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.