Experts Find URLScan Security Scanner 'urlscan.io' Inadvertently Leaks Sensitive URLs and Data

guest · Nov 8, 2022

By Ravie Lakshmanan - November 7, 2022

Security researchers are warning of "a trove of sensitive information" leaking through urlscan.io, a website scanner for suspicious and malicious URLs.

"Sensitive URLs to shared documents, password reset pages, team invites, payment invoices and more are publicly listed and searchable," Positive Security co-founder, Fabian Bräunlein, said in a report published on November 2, 2022.
Click to expand...

The Berlin-based cybersecurity firm said it started an investigation in the aftermath of a notification sent by GitHub in February 2022 to an unknown number of users about sharing their usernames and private repository names (i.e., GitHub Pages URLs) to urlscan.io for metadata analysis as part of an automated process.

Urlscan.io, which has been described as a sandbox for the web, is integrated into several security solutions via its API.
Click to expand...

On top of that, the analysis has also found that misconfigured security tools are submitting any link received via mail as a public scan to urlscan.io.

This could have serious consequences wherein a malicious actor can trigger password reset links for the affected email addresses and exploit the scan results to capture the URLs and take over the accounts by resetting to a password of the attacker's choice.
Click to expand...

Urlscan.io, following responsible disclosure from Positive Security in July 2022, has urged users to "understand the different scan visibilities, review your own scans for non-public information, review your automated submission workflows, [and] enforce a maximum scan visibility for your account."

It has also added deletion rules to regularly purge delete past and future scans matching the search patterns, stating it has domain and URL pattern blocklists in place to prevent scanning of particular websites.

"This information could be used by spammers to collect email addresses and other personal information," Bräunlein said. "It could be used by cyber criminals to take over accounts and run believable phishing campaigns."
Click to expand...

Log in or Sign up

Experts Find URLScan Security Scanner 'urlscan.io' Inadvertently Leaks Sensitive URLs and Data

guest Guest

Log in or Sign up

Experts Find URLScan Security Scanner 'urlscan.io' Inadvertently Leaks Sensitive URLs and Data

guest Guest

Useful Searches