제출 #661361: Tomofun Furbo 360 ≤ FB0035_FW_036 Server Side Request Forgery정보
제목
Tomofun Furbo 360 ≤ FB0035_FW_036 Server Side Request Forgery
설명
An attacker who compromises the Furbo account of a legitimate user can coerce the device to make a request to an attacker-controlled server by modifying the URL which is sent during the recording of a new treat toss sound. The end result is that the Furbo will download a file from the attacker's server.