Broken link hijacking in https://kubernetes-csi.github.io/docs/drivers.html?highlight=chubaofs#production-drivers
Low
K
Kubernetes
Submitted None
Actions:
Reported by
0xlegendkiller
Vulnerability Details
Technical details and impact analysis
Report Submission Form
## Summary:
When a web application has any pages, sources, links to external 3rd party services and are broken then the attacker can claim those endpoints to successfully conduct the attack and claim those endpoints on behalf of the target website and impersonate his identity.
## Steps To Reproduce
1) Visit `https://kubernetes-csi.github.io/docs/drivers.html?highlight=chubaofs#production-drivers`
2) Search for ChubaoFS
3) Click on that link
(Steps I followed -->
Click Link
{F1601565}
404 Error
{F1601567}
Change my Username to match the broken link
{F1601566}
Create the required repo.
{F1601568}
4) You will be redirected to My github repo
5) When someone clicks on the ChubaoFS link they will be redirected to the attacker repository
## Supporting Material/References:
1. `https://hackerone.com/reports/1031321`
2. `https://hackerone.com/reports/1117079`
3. `https://edoverflow.com/2017/broken-link-hijacking/`
## Impact
The user will install the wrong drivers which leads to impersonation attacks. The attacker can install Ransomware, trojan, etc.
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Bounty
$100.00
Submitted
Weakness
Insecure Temporary File