Potential Data LEAK in Getresponse (API)
Hello guys,
Just wanted to warn you all that I found a potential potential security breach in how Getresponse handles API errors.
Context: this is for people who use any program that asks for your api key ; or use their api key themselves.
Note: the Api Key in a Getresponse Account is as important as your email/password
When does the risk occurs: Well, when you use an app (a membership service for example). If the membership platform tries to add a new user, or perform any other action through the API... if it works fine, then there is nothing to worry about.
But, if there is an error, the GetResponse system throws an error that COMMUNICATES YOUR API KEY inside it. Which is very, very risky.
The error message starts "Uncaught Exception 'Runtime Exception'..."
For those of you who know their code, this can be valuable. For Getresponse, I sent them an email about this; I hope they'll get around to fixing it.
Goes to show you how lousy they are when it comes to coding; I'm personally not surprised at all that they'd leave a risk like this in their code.
Take care, and stay safe
Just wanted to warn you all that I found a potential potential security breach in how Getresponse handles API errors.
Context: this is for people who use any program that asks for your api key ; or use their api key themselves.
Note: the Api Key in a Getresponse Account is as important as your email/password
When does the risk occurs: Well, when you use an app (a membership service for example). If the membership platform tries to add a new user, or perform any other action through the API... if it works fine, then there is nothing to worry about.
But, if there is an error, the GetResponse system throws an error that COMMUNICATES YOUR API KEY inside it. Which is very, very risky.
The error message starts "Uncaught Exception 'Runtime Exception'..."
For those of you who know their code, this can be valuable. For Getresponse, I sent them an email about this; I hope they'll get around to fixing it.
Goes to show you how lousy they are when it comes to coding; I'm personally not surprised at all that they'd leave a risk like this in their code.
Take care, and stay safe