Unikrn · Report #507012
bypass Claudflare access crm.mautic.com
Validstatus
7upvotes
5 Apr 2019disclosed
How it was found
Hi @unikrn!
Hello, I see that when you switch to the crm,unikrn.com, login attempts are filtered by Claudflare Access to avoid brute-force account attacks, but we can ByPASS Claudflare access. Example:
https://crm.unikrn.com/oauth/v2/authorize_login
Impact
having accounts, we can easily get into the admin area