FreshBooks, a Canadian unicorn startup that builds cloud accounting software, keeps its Amazon Web Services (AWS) storage buckets that hold sensitive employee information unprotected over the internet so people don’t know where to look. made it available to anyone with a disability, experts claim.
As a result, more than 30 million users in over 160 countries around the world were exposed to impersonation and other cybercrime.
Warning issued by Cybernews (opens in new tab) A research team that first discovered the database in late January 2023.
easy-to-crack password At first glance, the storage images and blog metadata were preserved, but further analysis uncovered backups of the website’s source code, site information, configuration, and 121 WordPress login data. (opens in new tab) user. Login data (username, email address, and hashed password) belonged to the administrator of the site. They were hashed using the “easily crackable” MD5/phpass hashing framework, the researchers said, suggesting that obtaining the information in plaintext is relatively straightforward.
According to the Cybernews team, with this information, the attackers could have accessed the website’s backend and made unauthorized changes to its content. They analyzed the source code, understood how the website works, and may have found other vulnerabilities to sell or exploit. In fact, the researchers found that the 2019 server backup contained “at least five” vulnerable plugins that had been installed on the website at that time.
In a more dangerous scenario, it could have installed malicious software, moved laterally across networks, and stolen sensitive data.
However, there is a caveat to exploiting this vulnerability. “The login page to the website’s administration panel was protected and not publicly accessible,” the researchers explained. “However, an attacker could bypass this security measure by connecting to the same network as her website or by finding and exploiting a vulnerable WordPress plugin.”
Via: Cyber News (opens in new tab)
websitebuildersnow
GIPHY App Key not set. Please check settings