A security researcher has discovered multiple one-click client-side vulnerabilities in the some of the world’s most popular and widely-used web hosting companies that could have put millions of their customers as well as billions of their sites’ visitors at risk of hacking.
Independent researcher and bug-hunter Paulos Yibelo, who shared his new research with The Hacker News, discovered roughly a dozen serious security vulnerabilities in Bluehost, Dreamhost, HostGator, OVH, and iPage, which amounts to roughly seven million domains.
Some of the vulnerabilities are so simple to execute as they require attackers to trick victims into clicking on a simple link or visiting a malicious website to easily take over the accounts of anyone using the affected web hosting providers.
Critical Flaws Reported in Popular Web Hosting Services
Yibelo tested all the below-listed vulnerabilities on all five web hosting platforms and found several account takeover, cross-scripting, and information disclosure vulnerabilities, which he documented on the Website Planet blog.
- Information leakage through cross-origin-resource-sharing (CORS) misconfigurations
- Account takeover due to improper JSON request validation CSRF
- A Man-in-the-middle attack can be performed due to improper validation of CORS scheme
- Cross-site scripting flaw on my.bluehost.com allows account takeover (demonstrated in a proof-of-concept, below)
2. Dreamhost—the hosting provider that powers one million domains was found vulnerable to:
- Account takeover using cross-site scripting (XSS) flaw
- Site-wide CSRF protection bypass allows complete control
- Multiple CORS misconfigurations leading to information leak and CRLF
4. OVH Hosting—the company that alone powers four million domains around the world was found vulnerable to:
- CSRF protection bypass
- API misconfigurations
5. iPage Hosting
- Account takeover flaw
- Multiple Content Security Policy (CSP) bypasses
images from Hacker News