Amazon packaging feedback cross-site scripting vulnerability

#1

Post by bitquark » Fri, Aug 16, 2013, 12:21 PM UTC

Amazon packaging feedback cross-site scripting vulnerability
bitquark.co.uk

Re: Amazon packaging feedback cross-site scripting vulnerability

#2

Post by potatolicious » Fri, Aug 16, 2013, 2:34 PM UTC

I've sometimes wondered if code I've worked on will ever make it onto HN.

This was not the preferred way ;)

Though in my defense, this code was written before I got there... But I'm pretty sure I've been through this exact code afterwards and never found the vulnerability.

Re: Amazon packaging feedback cross-site scripting vulnerability

#3

Post by bitquark » Fri, Aug 16, 2013, 3:56 PM UTC

potatolicious wrote: post #2

I've sometimes wondered if code I've worked on will ever make it onto HN. This was not the preferred way ;) Though in my defense, this code was written before I got there... But I'm pretty sure I've been through this exact code afterwards and never found the vulnerability.

Nice to meet you! There's always one that slips through the net ;-)

Re: Amazon packaging feedback cross-site scripting vulnerability

#4

Post by joshfraser » Fri, Aug 16, 2013, 4:53 PM UTC

I reported a different vulnerability to Amazon a few days ago. I've gotten a case number, but haven't heard anything beyond that. It's nice to see their timeline and know that they are responding and fixing stuff.

Re: Amazon packaging feedback cross-site scripting vulnerability

#5

Post by swang » Fri, Aug 16, 2013, 5:24 PM UTC

I wonder why Amazon doesn't offer a bounty, even one that is a token amount.

Re: Amazon packaging feedback cross-site scripting vulnerability

#6

Post by [deleted] » Fri, Aug 16, 2013, 5:41 PM UTC

[deleted]

Re: Amazon packaging feedback cross-site scripting vulnerability

#7

Post by UnoriginalGuy » Fri, Aug 16, 2013, 5:43 PM UTC

swang wrote: post #5

I wonder why Amazon doesn't offer a bounty, even one that is a token amount.

People often whine more about a "token amount" more than they do a "thank you" in my experience.

Re: Amazon packaging feedback cross-site scripting vulnerability

#8

Post by MysticFear » Fri, Aug 16, 2013, 9:49 PM UTC

I would be curious if the author would have investigated further if he knew for certain no monetary benefit would have been given by Amazon.

Re: Amazon packaging feedback cross-site scripting vulnerability

#9

Post by bitquark » Fri, Aug 16, 2013, 10:41 PM UTC

MysticFear wrote: post #8

I would be curious if the author would have investigated further if he knew for certain no monetary benefit would have been given by Amazon.

Of course! I did know for certain there was no monetary benefit. A t-shirt would have been nice, but I investigated for the fun of it.