Hiro · Report #269184
Weak crossdomain.xml
Informativestatus
1upvotes
18 Jan 2018disclosed
Summary
The e-mail list management service used by Blockstack (operated by MailChimp) has a lenient cross-domain flash policy -- this is not a vulnerability, however, the crossdomain.xml used by the mailing service is more lenient than used by normal web services.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.