SoundCloud Fixed API Flaws That Could Lead to Account Takeover

guest · Feb 11, 2020

SoundCloud Fixed API Flaws That Could Lead to Account Takeover
February 11, 2020
https://www.bleepingcomputer.com/ne...pi-flaws-that-could-lead-to-account-takeover/

Social audio platform SoundCloud fixed multiple security vulnerabilities affecting its application programming interface (API) that could allow potential attackers to take over accounts, launch denial of service attacks, and exploit the service according to the Checkmarx Security Research team.
Taking over SoundCloud accounts
According to a report shared with BleepingComputer, while investigating the online music platform for API security flaws, the Checkmarx researchers found several vulnerabilities in SoundCloud's API endpoints that attackers could exploit to launch attacks directed at the platform and its users.

A Broken Authentication issued affecting the /sign-in/password endpoint of api-v2.soundcloud.com could have allowed attackers to launch automated credential stuffing attacks that would help them harvest valid access tokens.
Denial of service attacks
Two other bugs in the /tracks and /me/play-history/tracks endpoints of api-v2.soundcloud.com could have allowed for DoS and DDoS attacks because of the lack of improper rate and resources limiting.
Click to expand...

Checkmarx: Checkmarx Research: SoundCloud API Security Advisory

Log in or Sign up

SoundCloud Fixed API Flaws That Could Lead to Account Takeover

guest Guest

Log in or Sign up

SoundCloud Fixed API Flaws That Could Lead to Account Takeover

guest Guest

Useful Searches