Later archive addition

XSS using quirky implementations of ACME HTTP-01

Detectify · Labs Detectify · 4 September 2018

The article examines ACME HTTP-01 validation implementations that mishandled the challenge response as active web content. By controlling challenge material or validation behavior, an attacker could make certificate-validation endpoints serve script in a trusted origin and obtain cross-site scripting.

Record

Researcher

Detectify

Published by

Labs Detectify

Date

4 September 2018

In the archive

• Added to the 2018 archive after the original list was published

Tags

• xss
• tls
• origin-validation
• owasp-a02-2021
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of Detectify, first published at the original source. Preserved copies are kept so the citation survives its host.