NordVPN Quietly Plugged Vulnerability

[upnorth]

Content source

https://www.theregister.co.uk/2020/03/06/nordvpn_no_auth_needed_view_user_payments/

A vulnerability in NordVPN's payments platform allowed anyone to view users' payment information and email addresses, a startling HackerOne entry has revealed.

By simply sending an HTTP POST request without any authentication at all to join.nordvpn.com one could read off users' email addresses, payment method and URL, currency, amount paid and even which product they bought. The patched flaw was made public in early February on the HackerOne bug bounty platform and was forwarded to The Register by concerned reader Matt, who told us: "Note that this is regardless of whether the users had set strong passwords and otherwise wouldn't be vulnerable to credential-stuffing attacks."

NordVPN quietly plugged vuln where an HTTP POST request without authentication would return detailed customer data

Fiddle with some numbers and voila

www.theregister.co.uk

 

[Cortex]

Nord are having a bad time of it lately, I assume they will still be the best best VPN along with Express & Ghost on those trustworthy VPN comparison sites

 

[dinosaur07]

For me isn't clear if this is NordVPN's bug or their payment processor's fault. If it's theirs, I wonder how they can secure the connection made with their VPN server (virtual or bare metal) while they're not able to secure the sensitively payment details. Strange thing happen.

 

[blackice]

And I continue to not trust em’ as far as I could chuck em’.