We tested popular web hosting companies and all were easily hacked

We tested popular web hosting companies and all were easily hacked
websiteplanet.com

Here's a quick breakdown:

1. Autogenerating CORS headers based on a regexp that can be tricked into allowing .evil.org.

2. A form POST encoded text/plain that gets interpreted as JSON to bypass CSRF check.

3. Using CORS origin check gaps to do an HTTP downgrade.

4. XSS-ATO by email address changes (this is pretty vanilla).

5. Sending “token[]=” to break PHP CSRF token check through type confusion.

6. Breaking a different CORS generator by smuggling the whitelisted domain into a ?urlparam=safe.org.

7. Setting content-type=text/plain; application/json to fake out browser check for JSON and bypassing CSRF at OVH.

8. Some fiddly and not super interesting CSP bypasses.

But hosting management also has a whole lot of potential for logical errors. I work at a B2B ISP that is also a managed service provider, and every now and then somebody calls for more self-service. I'm not against it, but it's full of landmines.

It starts with such simple things as account creation. We allow accounts with the appropriate roles to be used for several different customers, which means we cannot namespace them by tenant.

We used to give accounts usernames based on the first and last name, but that makes it very easy to leak which other accounts exists (when "John Doe" becomes "johndoe4" instead of just "johndoe", you can infer the existence of other accounts, and thus that other "John Doe"s are among our customer base). We had to change that, which isn't as easy as it sounds for a company that has been doing things a certain way for 25 years.

Potential logic errors and information leaks lurk in all places where you cannot namespace things because they are not fully under your control, which can be IP addresses (big customers bring their own address spaces, and IPv4 address space is too small for generous segmentation), Domains, email addresses, phone numbers and so on.