generic image
Processing...
  • Games
  • Catalog
  • Develop
  • Robux
  • Search in Players
  • Search in Games
  • Search in Catalog
  • Search in Groups
  • Search in Library
  • Log In
  • Sign Up
  • Games
  • Catalog
  • Develop
  • Robux
   
ROBLOX Forum » Roblox » Suggestions & Ideas
Home Search
 

You should fix this...

Previous Thread :: Next Thread 
XxGOATSWAGxX is not online. XxGOATSWAGxX
Joined: 01 Feb 2014
Total Posts: 77
19 Jul 2014 01:06 PM
I am XxGOATSWAGxX, and I found two vulnerabilities within the ROBLOX website. These 2 vulnerabilities are not a huge problem, but need to be fixed.

First one, is a HTML form without CSRF protection. This affects All as followed:
/
/Login/Signup.aspx
/New/Login
/newlogin (a2c066965000a0859bf5e6bdaea18035)

The impact of vulnerability:
An attacker may force the users of a web application to execute actions of the attacker's choosing. A successful CSRF exploit can compromise end user data and operation in case of normal user. If the targeted end user is the administrator account, this can compromise the entire web application.

How to fix this vulnerability:

Check if this form requires CSRF protection and implement CSRF countermeasures if necessary.









The second vulnerability I found in an insecure transition from HTTP to HTTPS.
Affects all as followed:
/

The impact:
Possible information disclosure.

How to fix:
The form should be served from a secure (https) page.


Fix these, if not done already.

Am I able to get Red Banded Top Hat for this?
Report Abuse
kingkiller1000 is not online. kingkiller1000
Joined: 12 Dec 2008
Total Posts: 26415
19 Jul 2014 01:10 PM
Don't post this on the forums. E-mail Roblox instead.
Report Abuse
Cahier is not online. Cahier
Joined: 20 Jul 2010
Total Posts: 1796
19 Jul 2014 01:11 PM
*clap clap*

I'm impressed.
Report Abuse
Previous Thread :: Next Thread 
Page 1 of 1
 
 
ROBLOX Forum » Roblox » Suggestions & Ideas
   
 
   
  • About Us
  • Jobs
  • Blog
  • Parents
  • Help
  • Terms
  • Privacy

©2017 Roblox Corporation. Roblox, the Roblox logo, Robux, Bloxy, and Powering Imagination are among our registered and unregistered trademarks in the U.S. and other countries.



Progress
Starting Roblox...
Connecting to Players...
R R

Roblox is now loading. Get ready to play!

R R

You're moments away from getting into the game!

Click here for help

Check Remember my choice and click Launch Application in the dialog box above to join games faster in the future!

Gameplay sponsored by:
Loading 0% - Starting game...
Get more with Builders Club! Join Builders Club
Choose Your Avatar
I have an account
generic image