Read Time:21 Second
Posted by Georgi Guninski on Apr 21
There is minor information disclosure vulnerability similar
to nmap in browser.
It is possible to check the existence of firewalled URL U via
the following javascript in a browser:
<script src=”U”
onload=”alert(‘Exists’)”
onerror=”alert(‘Does not exist’)”>
This might have privacy implication on potentially
“semi-blind CSRF” (XXX does this makes sense?).
Works for me in…