Option 2 - Security Vulnerability

Security is one of the most important aspects of software development. A single mistake can take down entire companies due to data leaks, unauthorized access, and more. This doesn’t even account for the potential damage to the users of the software.

This assignment is to find and report a security vulnerability in the Learn Software App. YOU MUST NOT:

• Access any other students profile or data
• Assume the identity of another student
• Access any other teams profile or data

My user ID (for Julian Nadeau) is 49. You may use that profile if you wish to demonstrate a vulnerability.

You can find and report as many vulnerabilities as you can, but can only obtain up to 2% among all bonus assignments.

• Requirements
• Submission
• Rubric

Requirements

• Find a security vulnerability
• Include a script and/or steps to demonstrate proof of concept
• Be a vulnerability of adequate impact that:
  • Gains unauthorized access
  • Privilege escalation (make the system think you’re an instructor or admin)
  • Data leaks or manipulations
  • XSS, CSRF, etc
  • Unauthorized redirects
  • other similar kinds of attacks
• Fix it with a pull request

Submission

Create an issue on the Learn Software App Repo. Note: always look for a security policy before posting so you don’t accidentally divulge a vulnerability before it can be fixed.

Rubric