657
stop over engineering (programming.dev)
submitted 10 months ago by to c/programmer_humor@programming.dev
64 comments fedilink hide all child comments
 
you are viewing a single comment's thread
view the rest of the comments
[–] 1 point 10 months ago (1 child)

I haven't been down to test their public wifi in the cafe to see if that can access it.

The guy who installed it used to work for us and is a known clown, so it's entirely possible.

Although if it is, there's way worse things they can do from there. Like connect to the actual database for a start.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 10 months ago

    Does the database use the same authentication and permissions as the API? If the API authenticates against the DB with a technical user, it may be still be an exploitable vulnerability for people who can't access the DB directly but can access the API. I don't know what database it is, what other databases run on the same server and what privileges might be achievable or escalatable, but generally "there are worse weaknesses" isn't a solid security policy.

    You could give me a VPN access and I'll take a look around :p

    (Please don't, actually – in case it needs to be said, running pentests on prod is a dangerously bad idea already even before we get to the whole "trusting a stranger on the Internet just because they sound sorta knowledgeable" issue)

  • permalink
  • fedilink
  • source
  • parent