News for hackers. Stuff that matters.

A comment on HTTP Desync Attacks: Request Smuggling Reborn.

Re:HTTP Desync Attacks: Request Smuggling Reborn by Steltek on Thursday August 08, 2019 @12:01PM (#20645723)
I've been waiting to hear more about this since the abstract was published.

What was the timelines involved here? PayPal, Trello, and others were contacted over the course of this investigation. It would be nice to know what their response times were to such a serious vulnerability.

[ Parent | on HN ]
Re:HTTP Desync Attacks: Request Smuggling Reborn by albinowax_ on Friday August 09, 2019 @09:47PM (#20659657)
You can now see the PayPal timelines here: https://hackerone.com/reports/488147 https://hackerone.com/reports/510152

Trello patched it in roughly 10 days. In general I found companies took longer to patch this issue than other similar-severity vulnerabilities, probably because it's conceptually unfamiliar so I frequently had to spend quite a while explaining it, and the patch itself appears to be challenging sometimes too.

[ Parent | on HN ]