Stellar.org · Report #239479

HTTP - Basic Authentication on https://www.stellar.org/wp-login.php

N/Astatus

mediumseverity

7upvotes

13 Jun 2017disclosed

How it was found

Greetings, noticed https://www.stellar.org/wp-login.php using basic authentication.

#PoC: YWRtaW46YWRtaW4= is base64 encode of admin:admin #Impact:

Vulnerable to client side attacks. Vulnerable to MITM attack. Vulenrable to Eavesdropping attack. Vulnerable to Brute force attacks.

#Fix: HTTP-Basic Authentication should be changed for HTTP-Digest Authentication.

Let me know if any further info is required.

Regards, Mr.R3boot.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original