Typeform fixes Zendesk Sell form data hijacking vulnerability

guest · Jan 11, 2021

Typeform fixes Zendesk Sell form data hijacking vulnerability
January 11, 2021
https://www.bleepingcomputer.com/ne...ndesk-sell-form-data-hijacking-vulnerability/

Online surveys and form building software as a service Typeform has patched an information hijacking vulnerability.
The flaw which existed in Typeform's Zendesk Sell app integration could let attackers quietly redirect form submissions with potentially sensitive data to themselves.

Under normal circumstances, knowledge of this form ID would merely let any user access and fill the corresponding survey.
However, a severe vulnerability in Typeform meant, attackers could covertly gather responses submitted by respondents for virtually any form, should they have knowledge of this ID.
Click to expand...

Broken Zendesk integration lets attackers hijack submissions
Without explicitly naming Typeform, bug bounty hunter Ronak Patel recently provided details on an Insecure Direct Object Reference (IDOR) bug that impacted "an app [used] to generate forms for surveys, quiz and more."

On further investigation, BleepingComputer identified the flaw had existed in Typeform.
IDOR vulnerabilities occur when a system object which has a reference can be accessed in an unauthorized manner directly by users.
Click to expand...

The researcher's detailed findings on the integration vulnerability can be found in his blog post.
Click to expand...

Log in or Sign up

Typeform fixes Zendesk Sell form data hijacking vulnerability

guest Guest

Log in or Sign up

Typeform fixes Zendesk Sell form data hijacking vulnerability

guest Guest

Useful Searches