Skip to content

Slack· Tessellate Pay workspace

Alerts are waiting for a channel

61 sent in 7 days · 3 waiting · posting to #security

Not delivering

Connected by Kelvin on 3 Oct

#security archived at 07:04 · retrying every 5 minutes

3 alerts are waiting for a channel

Someone archived #security, the channel every alert goes to. One of the waiting alerts is the proven SSRF on the API. Pick a channel and they go straight out, in order.

The incident

#security was archived at 07:04

Noticed 2h ago · each alert keeps its place in the queue

  • Confirmed exploitable · criticalServer-side request forgery in Next.js 14.1.0 on api.tessellatepay.com. The out-of-band check fired.Waiting since 6m ago
  • 3 findings are due tomorrowOrigin IP exposed behind the WAF (high), missing CSP on status (medium), no rate limiting on 3 hosts (medium).Waiting since 1h ago
  • New asset foundstaging-2.tessellatepay.com answered on 443 for the first time. Monitor it, mark it not ours, or ignore it.Waiting since 2h ago

What's worth a ping

Only what someone should act on

6 of 7 on · everything else waits for the digest

  • Proven exploitableA finding our own test confirmed
  • On CISA's exploited listSomething you run that attackers are using now
  • Fix-by datesDue tomorrow, or already past
  • New assetsA host or name that turned up on its own
  • Vendor grade dropsA vendor falls a letter
  • Dark web, criticalAccess to you for sale, or your staff's logins posted
  • Scans that fall shortPartial or failed, so nothing closed

The connection

Connected by Kelvin on 3 Oct

Tessellate Pay workspace