Standard · your domain · Weekly · Mon 5 Oct, 02:00 · 20m 31s
31 names · 20 live · 17 issues, 1 proven exploitable · complete · 1 new since Thu 1 Oct · 1 not rechecked
CVE-2024-34351 · confirmed by our own template · api.tessellatepay.com
Proven on api.tessellatepay.com: our template made your server call out to us. An attacker can use the API server to reach internal services, including the AWS metadata endpoint that hands out credentials.
How far it reached
From every name we could find for tessellatepay.com to the ones that need you
Point at a step to see its hosts.
Everything out there under your name
31 names · 20 answer on the web · in the engine's order: live, then worst
Where your hosts answer from
6 in 3 places on the map · 9 behind edge networks · 8 on platforms
On the map
No one place
Behind an edge network the nearest of its data centres answers; on a platform we only know its address. Neither has one place to draw.
What follows from it
Countries
Cloud and edge
Platforms
What to fix first
17 issues, ranked by proof, then exploitation in the wild, then severity · changes since Thu 1 Oct
Proven exploitable · 1
Exploit code is public · 1
Everything else, worst first · 15
Does each page tell the browser how to protect it?
18 pages read · 5 send all six
| Host | HSTS5 without | CSP9 without | Framing3 without | No-sniff1 without | Referrerall | Permissions2 without |
|---|---|---|---|---|---|---|
1 host needs a look
Only problems are reported · 19 of 20 live hosts clean
TLSv1 and TLSv1.1 still accepted
Medium · 1 host
Turn off TLS 1.0 and 1.1; offer TLS 1.2 and 1.3 only.
Can someone send email as tessellatepay.com?
Seven checks on tessellatepay.com · 3 need a look
Yes, quite easily
DMARC is set to report only (p=none), so mail pretending to be you is still delivered. You'd hear about it afterwards.
MX
Where your mail goes
2 MX record(s)
0 tessellatepay-com.mail.protection.outlook.com
SPF
Who may send as you
SPF ends in -all: only listed senders may send
v=spf1 include:spf.protection.outlook.com include:sendgrid.net -all
DMARC
What receivers do with fakes
DMARC policy is p=none: failures are reported, never blocked
v=DMARC1; p=none; rua=mailto:dmarc@tessellatepay.com
DKIM
Signatures on your mail
DKIM selector selector1 found
v=DKIM1; k=rsa; p=MIIBIjANBgkqh…
CAA
Who may issue your certificates
No CAA record: any certificate authority may issue for this domain
DNSSEC
Answers can't be forged
DNSSEC is not enabled
Zone transfer
Your whole zone can't be copied
Zone transfer refused by all 2 nameservers
Read from tessellatepay.com itself · subdomains share these records
3 open ports shouldn't face the internet
11 open on 6 hosts · common TCP ports on every origin
3000 · Common for dashboards and dev servers (Grafana, Node)
22 · Remote shell open to anyone: one weak key or password away from a server
8080 · Usually a dev or admin server that wasn't meant to be public
tessellatepay.comapp.tessellatepay.commerchants.tessellatepay.comauth.tessellatepay.compartners.tessellatepay.compay.tessellatepay.comassets.tessellatepay.comcards.tessellatepay.comwww.tessellatepay.com
2 of 22 technologies run a version with a known CVE
11 with their version on show · attackers read these too
Known CVEs
Authentication
CDN
CMS
Documentation
Issue trackers
JavaScript frameworks
Live chat
Load balancers
Monitoring
PaaS
Programming languages
Recruitment
Tag managers
Web frameworks
Web servers
Yes, on one host: the origin's address is public
20 live hosts checked · firewalls, rate limits and origin leaks
sits behind Cloudflare, but its server answers at 18.133.42.7, found in public certificate logs. Requests sent straight there skip the firewall and its rate limits.
Seen in crt.sh:app.tessellatepay.com
120 requests in 9.4s, every one answered. Password guessing and card testing go unchecked.
120 requests in 9.4s, every one answered. Password guessing and card testing go unchecked.
120 requests in 9.4s, every one answered. Password guessing and card testing go unchecked.
Answering directly
2 things anyone can pick up
Exposed files, credentials in public code, takeovers and storage
Subdomain can be taken over
High
CNAME → tessellate-legacy.herokuapp.com · Heroku says “No such app”
old.tessellatepay.com points at tessellate-legacy.herokuapp.com, which no longer exists. Anyone can create an app with that name and serve pages on your domain.
Source maps published
Low
https://app.tessellatepay.com/_next/static/chunks/main-3f9a1c.js.map · HTTP 200
JavaScript source map is public: the original source can be read.
{"version":3,"sources":["webpack://_N_E/./src/lib/auth.ts","webpack://_N_E/./src/lib/payments/Cloud storage
62 bucket names like yours tried across AWS, Google Cloud and Azure · 2 exist · all locked
gcp · tessellatepay-backups · locked (HTTP 403)
aws · tessellatepay-assets · locked (HTTP 403)
What can be reached, and how
1186 pages crawled · 276 API routes · 3 forms · 1 spec
An OpenAPI spec is public, describing 64 routes
https://api.tessellatepay.com/openapi.json
It’s a map of your API for anyone. Fine if it’s meant to be, worth closing if not.
| Method | Route | Params | Found by | Status |
|---|---|---|---|---|
| POST | app.tessellatepay.com/api/auth/login | email, password | XHR | 401 |
| GET | app.tessellatepay.com/api/auth/session | · | XHR | 200 |
| GET | app.tessellatepay.com/api/transactions | from, to, status, cursor | XHR | 401 |
| POST | app.tessellatepay.com/api/payouts | amount, currency, beneficiaryId | JavaScript | 401 |
| GET | app.tessellatepay.com/api/beneficiaries | · | JavaScript | 401 |
| GET | app.tessellatepay.com/api/exports/csv | range | JavaScript | 401 |
| GET | app.tessellatepay.com/sign-in | next | Crawl | 200 |
| GET | app.tessellatepay.com/forgot-password | · | Crawl | 200 |
| POST | app.tessellatepay.com/api/webhooks/test | url | Archives | 404 |
| GET | app.tessellatepay.com/_next/data/build/dashboard.json | · | Crawl | 200 |
| POST | api.tessellatepay.com/v1/charges | amount, currency, customer, metadata | API spec | · |
| GET | api.tessellatepay.com/v1/charges/{id} | id | API spec | · |
| POST | api.tessellatepay.com/v1/refunds | charge, amount | API spec | · |
| POST | api.tessellatepay.com/v1/transfers | amount, bank_code, account_number | API spec | · |
| GET | api.tessellatepay.com/v1/customers | email, limit | API spec | · |
| PUT | api.tessellatepay.com/v1/webhooks | url, events | API spec | · |
| POST | api.tessellatepay.com/v1/bvn/verify | bvn, first_name, last_name | API spec | · |
| GET | api.tessellatepay.com/internal/health | · | Archives | 200 |
Forms
Did it see everything?
19 stages · 20m 31s
So it can close anything it stops seeing. This time, nothing it had seen before was gone.
Ports weren’t scanned on 9 hosts behind a CDN, on purpose: the edge would answer, not your server.
Vulnerability templates
93%of requests completed
89,652 of 96,400 requests · 6,683 templates · 1,240 errors · below half, a clean result doesn’t count
Subdomains
Certificate logs and passive DNS datasets
32s · 31
DNS records
A, AAAA and CNAME for every name found
4s · 23
Live hosts
Which names answer on the web
8s · 20
Technologies
Frameworks, servers and versions
30s · 43
TLS
Certificates, protocols and ciphers
3s · 1
Security headers
HSTS, CSP, framing and cookies
4s · 21
DNS and email
SPF, DMARC, DKIM, CAA, DNSSEC, zone transfer
12s · 7
Takeovers
Names pointing at services no one owns
15s · 1
WAF and rate limits
Firewalls, rate limiting and origin leaks
44s · 12
Known CVEs (OSV)
Detected versions against open-source advisories
5s · 3
Known CVEs (NVD)
Detected versions against NIST's database and CISA's exploited list
17s · 0
Open ports
Common TCP ports on every origin
6m 2s · 20
Secrets and files
Keys in JavaScript, exposed .git, .env and backups
2m 3s · 1
Routes
Crawled pages, API routes, forms and specs
58s · 0
Cloud storage
Buckets named like you, and whether they're open
53s · 2
Vulnerability templates
Thousands of known flaws and misconfigurations
16m 41s · 1
Exploit intelligence
CVSS, EPSS and public exploits for each CVE
15s · 0
Services
What's listening on each open port
35s · 3
Proof
Firing each CVE's template to confirm it's exploitable
1m 42s · 0
Triage
Merging duplicates, ranking by real risk, explaining each
53s