Starbucks · Report #881548
Default credentials for the temporary POC site alipoc.stg.starbucks.com.cn permitted WAF bypass and RCE
Validstatus
mediumseverity
19upvotes
16 Jun 2020disclosed
Summary
neweq discovered that a temporary proof of concept site alipoc.stg.starbucks.com.cn was initially configured with default credentials for a brief period of time before being taken offline. @neweq — thank you for reporting this vulnerability and for confirming the resolution.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.