Vulnerability
vulnerability:bitly_account_history_flaw
Also: Bitly '+' flaw, Bitly bug
Flaw in which appending a plus sign to certain shortened URLs exposed a user profile and its previously shortened links.
Flaw in which appending a plus sign to certain shortened URLs exposed a user profile and its previously shortened links.
“if you add a ‘+’ to the end of any shortened link”
“see everything that they’d ever shortened using the service”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | AFFECTS | Bitly | Explicit | 148 |
| incoming | EXPLOITS | Professor Dubstep | Explicit | 148 |
Bitly account-history flaw AFFECTS Bitly
Professor Dubstep describes a Bitly flaw that exposed all links shortened by an account when a plus sign was appended to a shortened URL.
Explicit Confidence 99% · Professor Dubstep EP 148 Details
“they had a glaring flaw in their system where if you add a ‘+’ to the end of any shortened link”
Professor Dubstep EXPLOITS Bitly account-history flaw
Professor Dubstep says they used the Bitly account-history flaw to inspect management accounts and download internally shared links.
Explicit Confidence 99% · Professor Dubstep EP 148 Details
“we’d be able to just see those and download them”