Pushwoosh · Report #187025
Publicy accessible IDRAC instance at api-m.inapp.pushwoosh.com
Summary
Upon researching I discovered the internal Integrated Dell Remote Access system opened to the public. Since this was having some security risks, I reported the issue to the team. The Pushwoosh team was very responsible and fixed the issue fast, although the issue was not in the scope. Thanks to the team for the great experience and accepting this report!
How it was found
Hi. I discovered a publicy accessible IDRAC instance at api-m.inapp.pushwoosh.com. I know this subdomain is out of scope, but still consider to report it. Since default credentials root/calvin not work, there are no security risks for now, but so far the instance is available to public, in the future it may have some security risks, for example, if Dell firmware update will reset credentials to default, or new exploits for IDARC8 will appear. So i recommend you restrict the access to this system.