Severe Flaw Disclosed In StackStorm DevOps Automation Software

guest · Mar 11, 2019

Severe Flaw Disclosed In StackStorm DevOps Automation Software
March 11, 2019
https://thehackernews.com/2019/03/stackstorm-security-vulnerability.html

A security researcher has discovered a severe vulnerability in the popular, open source event-driven platform StackStorm that could allow remote attackers to trick developers into unknowingly execute arbitrary commands on targeted services.

Since StackStorm executes actions—which can be anything, from the HTTP request to an arbitrary command—on remote servers or services that developers integrate for automated tasks, the platform runs with quite high-privileges.

According to the details Barak Tawily, an application security researcher, shared with The Hacker News prior to the release, the flaw resided in the way the StackStorm REST API improperly handled CORS (cross-origin resource sharing) headers, eventually enabling web browsers to perform cross-domain requests on behalf of the users/developers authenticated to StackStorm Web UI.
Click to expand...

Log in or Sign up

Severe Flaw Disclosed In StackStorm DevOps Automation Software

guest Guest

Log in or Sign up

Severe Flaw Disclosed In StackStorm DevOps Automation Software

guest Guest

Useful Searches