After registration, I tried navigating to fdp.fifa.org - FIFA's Football Data Platform. The app authenticated me through the shared Entra tenant, checked my roles, found I had none, and showed me:

"Sorry, you do not have any FIFA Football Data Platform role assigned to your account."

Looks like it works, right? Access denied. Go away. Nothing to see here.

Except this was all client-side. The Angular app checked the JWT for a NO_ROLES marker and rendered the access-denied page. The backend APIs? They didn't check anything. They just served whatever you asked for.

no comments (yet)

sorted by: hot top controversial new old
there doesn't seem to be anything here
9 comments in c/technology@lemmy.world view that post
[–] 54 points 4 months ago (2 children)

FIFA never responded. Not to acknowledge the report. Not to say thank you. Not to discuss compensation. Nothing

Ungrateful bastards. He should've absolutely done Rick rolled the world. Maybe even played a segment on how corrupt infantino is.

Hell with that level of access he could've changed match statistics and made some spicy bets.

  • source
  • hideshow 2 child comments
  • [–] 44 points 4 months ago (1 child)

    Not Rickrolled but a long sequence of Epstein amd Trump photographs and documents.

  • source
  • hideshow 1 child comment
  • [–] 34 points 4 months ago

    could have? should have! what a waste

  • source
  • [–] 17 points 4 months ago*

    Fifa Agent Platform -> FAP

    pun intended?

  • source
  • [–] 8 points 4 months ago

    This is wild. Minimum wage employees kind of quality

  • source
  • [–] 3 points 4 months ago

    Amazing article, hope it's real

  • source
  • 3 comments in c/cybersecurity@sh.itjust.works view that post
    [–] 7 points 4 months ago*

    Bro what a good read! Lol fucking Fifa I believe it and understand how most of the system works. If he had fucked with it the FBI would be calling him!

  • source
  • [–] 6 points 4 months ago

    I demand proof!

  • source
  • Damn he really should fucked with them not even an acknowledgement much less a thank you

  • source
  • 1 comment in c/hackernews@lemmy.bestiver.se view that post
    [–] 3 points 4 months ago

    I was going to go ahead and say "if you could have and you didn't, you failed us", but then I actually read the article and basically FIFA either had the laziest, or the most inept IT dependent because it really is crazy that you can just sign up for a program with your ID and once they authenticate you you have access to everything even without any roles.

  • source