Show HN: Newsboard – A Hacker News Clone

Re:Show HN: Newsboard – A Hacker News Clone by jenoer on Tuesday August 25, 2020 @12:16PM (#24272904)

@robdelacruz: I have a few security-related findings for you that you might want to take a look at:

- I can inject any JavaScript in Titles, Tags and possibly other locations.

- By manually changing the value of the `userid` cookie, I can log in as any user ("1" for admin). This also allows me to access the admin section of the website.

- It's highly recommended to enable "HttpOnly" for session cookies. (Secure and SameSite should also be more strict if the application allows it)

Other remarks:

- There should be a limit on the length of submission titles, these are close to infinite it seems.

Edit: It seems others are completely defacing the board by using these tricks. I just want you to know that it's not me.

[ Parent | on HN ]

Re:Show HN: Newsboard – A Hacker News Clone by robdelacruz on Tuesday August 25, 2020 @10:43PM (#24278549)

Thanks for the bug reports. Much appreciated. Will take a look at these one by one. Hopefully to get the site back up and running.

Source code is at: https://github.com/robdelacruz/newsboard

[ Parent | on HN ]

Re:Show HN: Newsboard – A Hacker News Clone by zxcvbn4038 on Tuesday August 25, 2020 @02:13PM (#24274247)

This is why we can’t have nice things! Citibank had the same issue five or six years ago where once you logged in you could change the URL to any account. I think they lost something like $36 million before the hole was plugged.

[ Parent | on HN ]

Re:Show HN: Newsboard – A Hacker News Clone by willio58 on Tuesday August 25, 2020 @01:08PM (#24273509)

This is hilarious, people are having a javascript alert conversation on this site.

[ Parent | on HN ]