Skip to content

Commit

Permalink
Update README.md
Browse files Browse the repository at this point in the history
  • Loading branch information
ol3k authored May 12, 2017
1 parent 58dd782 commit c9b87c1
Showing 1 changed file with 8 additions and 7 deletions.
15 changes: 8 additions & 7 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,29 +1,30 @@
<b>Paywall Issue</b>
<b>Paywall Issue</b></br>

www.aachener-zeitung.de</br>
www.aachener-nachrichten.de</br>

<b>0. information</b>
<b>0. information</b></br>

The websites are offering a mixture of free and payed articles hidden by paywall. (http://www.aachener-zeitung.de/zva/pc/)
The websites use AESUtils and CryptoJS to hide articles.

The provider leaks sensitive data like password, IV and salt which are used for encryption and can be used to decrypt the articles.
The provider leaks <b>sensitive data like password, IV and salt which are used for encryption</b> and can be used to decrypt the articles.
<b>This issue does not leak any personal data of (registered) users.</b>

free article: http://www.aachener-zeitung.de/lokales/juelich/zukunft-von-haus-overbach-ist-langfristig-gesichert-1.1610013
hidden article: http://www.aachener-zeitung.de/lokales/juelich/feierabendmarkt-in-juelich-mit-bilderbuchstart-1.1622101

<b>1. timeline</b>
<b>1. timeline</b></br>

<ul>
<li>04.05.2017 20:53: informed "AZ - Lokales" via facebook pages about the possibility to read all hidden content (https://www.facebook.com/azlokalesaachen/)</li>
<li>04.05.2017 21:04: response with information that the issue will be forwarded</li>
</ul>

<b>2. PoC</b>
---
<b>2. PoC</b></br>
Code will be released after fix or responsible disclosure


<b>3. responsible disclosure</b>
<b>3. responsible disclosure</b></br>
disclosure until 04.08.2017
</ul>

0 comments on commit c9b87c1

Please sign in to comment.