Уровень 0 · материалов: 5
В кластер входят документы об уязвимостях, возникающих из-за отсутствия проверки данных на сервере, и не входят документы о других типах кибератак или общих методах разработки ПО.
Общие признаки: доверие к клиентским данным, обход ограничений интерфейса, манипуляция данными на стороне клиента, уязвимости безопасности веб-приложений
Группа выше: Инъекции и межсайтовый скриптинг
Смысл: The main idea is that trusting client-side input without server-side validation allows users to bypass UI restrictions and inject arbitrary data into a website's database.
The author demonstrates how to use browser developer tools to bypass input restrictions on VKontakte and Habr profiles due to a lack of server-side validation.
Смысл: The text illustrates how relying solely on client-side JavaScript for data validation is a security flaw, as users can manipulate the DOM to bypass these restrictions.
A user successfully bypassed input restrictions on the Gosuslugi portal by cloning DOM elements to remove JavaScript event listeners, highlighting a lack of server-side validation.
Смысл: The text demonstrates how a lack of server-side validation for relational data (specifically IDs for faculties and specialties) allows users to bypass front-end restrictions and inject arbitrary, outdated, or fictional information into their social media profiles.
A technical walkthrough on how to bypass VK's education validation by manipulating HTML attributes and IDs to add fictional degrees to a profile.
Смысл: The text illustrates a classic security flaw where a website trusts client-side data (cookies) for financial transactions without server-side verification, allowing users to set their own price for a product.
The author discovered and reported a bug on Vimeo that allowed purchasing a Plus account for $0.01 by editing a browser cookie.
Смысл: The text demonstrates how a lack of input validation in user profile fields on the GosUslugi portal allows users to send official, digitally signed emails containing arbitrary, potentially offensive text to third parties by manipulating their own account name.
The author discovered that GosUslugi's official email notifications can be abused to send custom, signed messages by setting a malicious account name.