DRIVE.NET, Inc. · Report #772039

Same site Scripting

Validstatus

lowseverity

49upvotes

13 Jan 2020disclosed

How it was found

Same site scripting I have found an error of some misconfigured DNS in a subdomain of yours which causes same site scripting.

PoC 1 Open a terminal and type ping localhost.drive2.ru You would see that it resolves back to 127.0.0.1 A screenshot has been attached

This may cause security issues in multiple user systems. An attack procedure can be found here : https://seclists.org/bugtraq/2008/Jan/270

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original