Starbucks Mobile Domain Vulnerable to Remote Code Execution

guest · Dec 11, 2020

Starbucks Mobile Domain Vulnerable to Remote Code Execution
December 10, 2020
https://www.technadu.com/starbucks-mobile-domain-vulnerable-remote-code-execution/230469/

The “mobile.starbucks.com.sg” domain belonging to Starbucks Singapore was found to be vulnerable to remote code execution (RCE) by security researcher and bug bounty hunter Kamil Onur Özkaleli (ko2sec). The man discovered an .ashx endpoint on the mobile domain that would permit unrestricted file type uploads.

The most straight-forward target through this would be to trigger an RCE situation. This is a critical severity (9.8) vulnerability that was discovered and reported on November 5, 2020, and for which the researcher received a bounty payment of $5,600.
While the HackerOne program that was run by the American coffeehouse company concerned the particular domain, the same vulnerability was to be found on more domains of the same family.
Click to expand...

Starbucks has made no comments on the finding, and neither have they stated anything about the possibility of malicious actors engaging in exploiting the discovered flaw.
Click to expand...

Log in or Sign up

Starbucks Mobile Domain Vulnerable to Remote Code Execution

guest Guest

Log in or Sign up

Starbucks Mobile Domain Vulnerable to Remote Code Execution

guest Guest

Useful Searches