101 Followers
·
Follow

InfluxDB Access at redact.8x8.com

Hi long times no see.I have 13 triaged report to write.I think it delay due to covid 19.Today i want to share how i found bug at 8x8.

I use shodan.io to search some service.

Dork : hostname:8x8.com

and i found one InfluxDB service.I googling for InfluxDB.

Authentication is disabled by default. All HTTP requests are executed when authentication is disabled.

Image for post
Image for post

I found this thread.InfluxDB’s auth is disable by default.So i try to send some query using curl.

curl -G "http://redact:8086/query" --data-urlencode 'q=show databases'

I got all databases list.

curl -G "http://redact:8086/query" --data-urlencode 'q=show users'

I got users list.

Image for post
Image for post

I report to 8x8 via hackerone.8x8 accepted my report and now resolved.

Image for post
Image for post

Thank for reading .See you in next bug and stay at home.

Written by

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store