Vulnerability Summary
After an initial 2FA bypass vulnerability was “fixed” by removing the isVerifyAuth cookie from local storage, the application still trusted this value if it existed.
Upon successful login with valid credentials, users are redirected to the OTP verification page at:
example.com/customer/verify-otp
During my initial inspection using DevTools, I verified the presence of the isVerifyAuth cookie, which was previously set to false. The company had removed this cookie from local storage as part of their security patch, resulting in its absence by default.
However, the application still accepted the cookie if it was manually reintroduced.
pyus3rAn unauthenticated AEM Sling servlet exposes four CRUD operations (getData / getDataById / setData / updateData) on the internal marketing-campaign database via a single option request header. The only access control is a Referer string check that any HTTP client trivially bypasses. Anonymous attackers can read the full 79-campaign dataset (including internal segmentation logic and the names of internal prospect databases), create arbitrary new campaigns in the production backoffice, and overwrite existing real production campaigns.
hackerone-reportsHackerOne disclosed report --> https://hackerone.com/reports/3676308 by glferreira-devsecops
gpk21No comments yet.
Be the first to share your thoughts
Log in to join the discussion.
Sign In