Enjin · Report #3589247
Unauthenticated File Upload to CDN
Summary
@ph0r3nsic demonstrated that it was possible to upload files to NFT.io with an unauthenticated session.
Whilst the endpoint used in the report only stored the files ephemerally (and therefore they would be purged after a few hours having not being captured), the Enjin team concluded there were no legitimate reason for an unauthenticated session to be able to interact with that endpoint in the first place and therefore pushed a fix to prevent it going forward.
The fix was deferred from release until the Monday as the issue was reported on Friday and didn't warrant an immediate resolution due to the low-impact nature of the vulnerability.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.