Tappedout Security Risk

User avatar
3drinks
Kaalia's Personal Liaison
Posts: 4832
Joined: 4 years ago
Pronoun: he / him
Location: Ruined City of Drannith, Ikoria

Post by 3drinks » 4 years ago

Do you use tappedout? If you're like me, you know it's always been a way to easily organize and sort decks and you've made great use over the years.

Apparently, their html coding is no longer safe and is posing a security vulnerability, so heads up, use at your own risk.

Modern
R{R/W} 87guide Burn
Commander
WRKellan, the Fae-Blooded // Birthright Boon (local secret santa gift)
RTorbran, Thane of Red Fell (Red Deck Wins)
WBRAlesha, Who Smiles at Death (Slivers)
WBRKaalia HQ

User avatar
Rorseph
Compleat Fool
Posts: 147
Joined: 4 years ago
Pronoun: they / them
Location: The Sixth Sphere of Phyrexia
Contact:

Post by Rorseph » 4 years ago

If that's the case, I guess I'm speeding up my personal migration to Archidekt. Do you have a source with more information?
"From void evolved Phyrexia. Great Yawgmoth, Father of Machines, saw its perfection. Thus The Grand Evolution began."
—Phyrexian Scriptures


Aurelia | Maelstrom Wanderer | Primer: Thassa | Uro | Primer: Volrath

User avatar
3drinks
Kaalia's Personal Liaison
Posts: 4832
Joined: 4 years ago
Pronoun: he / him
Location: Ruined City of Drannith, Ikoria

Post by 3drinks » 4 years ago

Rorseph wrote:
4 years ago
If that's the case, I guess I'm speeding up my personal migration to Archidekt. Do you have a source with more information?
I only heard of it in our Kaalia server on Discord. I don't know what I'd be looking for to confirm personally.

Modern
R{R/W} 87guide Burn
Commander
WRKellan, the Fae-Blooded // Birthright Boon (local secret santa gift)
RTorbran, Thane of Red Fell (Red Deck Wins)
WBRAlesha, Who Smiles at Death (Slivers)
WBRKaalia HQ

User avatar
Rorseph
Compleat Fool
Posts: 147
Joined: 4 years ago
Pronoun: they / them
Location: The Sixth Sphere of Phyrexia
Contact:

Post by Rorseph » 4 years ago

Considering that this thread is the first Google result for "tappedout security risk", maybe we should be careful about verifying this as factual before anything else.
"From void evolved Phyrexia. Great Yawgmoth, Father of Machines, saw its perfection. Thus The Grand Evolution began."
—Phyrexian Scriptures


Aurelia | Maelstrom Wanderer | Primer: Thassa | Uro | Primer: Volrath

User avatar
Feyd_Ruin
Elder Vampire
Posts: 5400
Joined: 4 years ago
Answers: 3
Pronoun: he / him
Contact:

Post by Feyd_Ruin » 4 years ago

They don't properly sanitize all of the user-driven output.
A Dev friend did a proof of concept <script> injection (it just created an alert popup), and pointed it out to them. They never responded. To my knowledge they haven't fixed the issue (but hopefully I'm wrong).
To the beaten, the broken, or the damned; the lost, and the wayward: wherever I may be, you will have a home.

User avatar
3drinks
Kaalia's Personal Liaison
Posts: 4832
Joined: 4 years ago
Pronoun: he / him
Location: Ruined City of Drannith, Ikoria

Post by 3drinks » 4 years ago

That's pretty dangerous, yeah?

Modern
R{R/W} 87guide Burn
Commander
WRKellan, the Fae-Blooded // Birthright Boon (local secret santa gift)
RTorbran, Thane of Red Fell (Red Deck Wins)
WBRAlesha, Who Smiles at Death (Slivers)
WBRKaalia HQ

User avatar
Feyd_Ruin
Elder Vampire
Posts: 5400
Joined: 4 years ago
Answers: 3
Pronoun: he / him
Contact:

Post by Feyd_Ruin » 4 years ago

If their site was targeted by a bad actor and you visited their deck, they could inject cross site scripting that could be bad. But hopefully they fixed the issue (or a new nudge will get them to)

Edit: I just confirmed the issue is still alive.
I'll email them and give them another nudge
To the beaten, the broken, or the damned; the lost, and the wayward: wherever I may be, you will have a home.

User avatar
Feyd_Ruin
Elder Vampire
Posts: 5400
Joined: 4 years ago
Answers: 3
Pronoun: he / him
Contact:

Post by Feyd_Ruin » 4 years ago

Screenshot_20200414-092449.jpg
Hit him up on discord, this should be fixed soon hopefully. :)
Tapped out is good people, and missing a sanitation happens to everyone.
To the beaten, the broken, or the damned; the lost, and the wayward: wherever I may be, you will have a home.

User avatar
3drinks
Kaalia's Personal Liaison
Posts: 4832
Joined: 4 years ago
Pronoun: he / him
Location: Ruined City of Drannith, Ikoria

Post by 3drinks » 4 years ago

That's great to see.

Modern
R{R/W} 87guide Burn
Commander
WRKellan, the Fae-Blooded // Birthright Boon (local secret santa gift)
RTorbran, Thane of Red Fell (Red Deck Wins)
WBRAlesha, Who Smiles at Death (Slivers)
WBRKaalia HQ

Post Reply Previous topicNext topic

Return to “Commander”