New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

security audit #147

Open

alberanid opened this issue Jun 27, 2016 · 0 comments

Labels

priority: high task

Milestone

Say Goodbye to Ev...

Member

alberanid commented Jun 27, 2016 •

edited

Loading

Verify that unregistered (non-admin) users can't:

update/delete events and tickets they don't own
access information about other tickets
impersonate other users

I'm pretty sure there are some vulnerabilities, especially:

access to paths that are supposed to be reserved to administrators
a way to impersonate other users forging a cookie
possibly, some NoSQL injection: https://www.owasp.org/index.php/Testing_for_NoSQL_injection
is the WebSocket really encrypted, when HTTPS is used?

Obviously I've put them intentionally, to entice you to join the development. 👍

alberanid added priority: high task labels

alberanid added this to the Say Goodbye to Eventbrite milestone

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment