10

I went to http://dev.stackexchange.com (I tried this out because I thought maybe there's a SE site for it, but it seems to redirect me to http://www.stackexchange.com) and logged in. I pressed the button that "sends SE information to this site" and I got logged in as... Blondie21?

Logged in as someone else

Edit

It seems to login random names (girlish names) for different people, and it seems to be a SE dev site.

33
  • 3
    What if. Just what if. You shouldn't be messing with dev stuff? Feb 20 '14 at 2:56
  • @michaelb958 Is that what dev.stackexchange.com is? Dev stuff?
    – Cilan
    Feb 20 '14 at 2:57
  • Seems most likely, given that dev.stackoverflow.com and dev.meta.stackoverflow.com are already proven to exist. Feb 20 '14 at 2:58
  • Hah! That's pretty great. OpenID auth fails for me, but I didn't earnestly expect it to work anyway.
    – user206222
    Feb 20 '14 at 3:00
  • 3
    Worked fine for me. Feb 20 '14 at 3:01
  • No issue with StackExchange account. Got normal account####. Feb 20 '14 at 3:06
  • Logging in with Google account I just see my normal user name. What login steps are you taking? Feb 20 '14 at 3:08
  • @MartinSmith I'm going to dev.SE and logging in, the same thing happened to my friend
    – Cilan
    Feb 20 '14 at 3:10
  • Are the inbox notifications displayed yours? Feb 20 '14 at 3:12
  • @MartinSmith No, not at all
    – Cilan
    Feb 20 '14 at 3:13
  • 3
    I logged in with my gmail account and got logged in as pauldawg, apparently a real stack overflow user. When I followed a link in the inbox to stack overflow, however, I arrived at the page under my correct account. Feb 20 '14 at 3:16
  • 1
    Maybe for older accounts the database ids are the same for dev and live but they got out of synch at some point? Feb 20 '14 at 3:22
  • 3
    This question appears to be off-topic because it is about the implementation of accounts on Stack Exchange's internal dev test network of sites, not on the public sites that non-employees should be concerned with.
    – Jeremy
    Feb 20 '14 at 3:45
  • 3
    @JeremyBanks Depends what the security implementations are really. Can this be used to post messages under another account or change credentials or read confidential information? Feb 20 '14 at 3:47
  • 1
    You should never expect dev tiers to work entirely as production sites do. ;) We're working on a fix.
    – Adam Lear StaffMod
    Feb 20 '14 at 18:39
5

This is a known issue. I'd already reported this1 a couple of months ago.

In the past there was a more serious vulnerability where the same thing would happen on dev.SO. Which leaks the email address of the dummy user (actually a real user taken from the dump).

As far as I can tell, there is no PII leak here, though, the bug is pretty harmless in itself.

Though this bug can possibly be leveraged to get deeper access (that was reported too). Don't try.

1. By proxy of @Undo, because he had a private room with the devs

2
  • Obviously it is probably fixed by now, but why tell someone not to try when it could help confirm a security problem with a clear fix?
    – Cilan
    Feb 2 '16 at 4:42
  • @Doorhandle If you have found a vulnerability and reported it (and know that it will be fixed), don't try and use that vulnerability to escalate, it's bad faith. Especially when the escalation has also been reported. Feb 2 '16 at 21:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .