Critical Vulnerability was discovered in Vladhog Security Bot

Today our security partner LinkShield told us and we confirmed critical vulnerability that could cause cache poisoning for bot results.

How cache working

When someone send to us url that was already checked, we still pass it with each check that we usually do, each of modules just check if url is in cache and result source was not current module, then we skip module and continue until result source module found.

How cache poisoning was working

When you using /link_check command, you can choose order in which bot will check urls. If you choose all modules that you sure url will bypass, bot will end up adding safe result to cache, and in next check with all modules bot will return cached result without checking with modules that could possibly block url.

What actions was taken

We updated bot to force /link_check command to not use cache and not add any results to cache.

Thank you for being with us!