Microsoft Addresses Serious Vulnerability in Translator Hub

guest · Jul 20, 2018

Microsoft Addresses Serious Vulnerability in Translator Hub
A serious vulnerability in the Microsoft Translator Hub could be exploited to delete any or all of the 13000+ projects hosted by the service, a security researcher has discovered.
July 20, 2018
https://www.securityweek.com/microsoft-addresses-serious-vulnerability-translator-hub

According to Microsoft, the Translator Hub allows enterprises build translation systems, and allows governments, universities and language preservation communities to “build translation systems between any pair of languages, including languages not yet supported by Microsoft Translator, and reduce communication barriers.”

While hunting for vulnerabilities on the Hub, security researcher Haider Mahmood discovered that the HTTP request for removing a project contained the “projectid” parameter, which is the ID of the individual project in the database.

Further analysis of the issue revealed an Indirect Object Reference vulnerability, which could essentially allow an attacker to set any ProjectID in the HTTP project removal request and delete any of the projects in Microsoft Translator Hub.

In fact, by iterating through project IDs starting from 0 to 13000, an attacker could delete all projects from the database, the security researcher reveals.
Click to expand...

Log in or Sign up

Microsoft Addresses Serious Vulnerability in Translator Hub

guest Guest

Log in or Sign up

Microsoft Addresses Serious Vulnerability in Translator Hub

guest Guest

Useful Searches