Security Scan Report for ArcBlock.io
A security scan was conducted on https://www.arcblock.io/, revealing several vulnerabilities that could potentially expose sensitive user data and administrative controls. The findings are categorized as follows:
1️⃣ Security Header Issues
✅ Strict-Transport-Security is properly set. ❌ Content-Security-Policy (CSP) is missing, making the site vulnerable to cross-site scripting (XSS) attacks. ✅ Other headers like X-Frame-Options, X-XSS-Protection, and X-Content-Type-Options are correctly configured.
2️⃣ Publicly Accessible Crypto & Admin Endpoints
⚠️ Several sensitive endpoints are publicly accessible, increasing the risk of unauthorized access and data breaches. These include:
- Admin Panel:
/admin,/wp-login.php - API Endpoints:
/api/v1/balance,/api/v1/transactions,/api - User Wallet & Funds:
/wallet,/withdraw - Debugging & Server Info:
/node-status,/debug,/.git
🛑 Risk: Attackers can exploit these endpoints to access user balances, transactions, and potentially withdraw funds.
3️⃣ Open Directory Listing
✅ No open directories were found, reducing the risk of directory traversal attacks.
🔹 Recommended Fixes
- Implement a Content-Security-Policy (CSP) to prevent XSS attacks.
- Restrict access to sensitive endpoints using authentication, IP whitelisting, or firewalls.
- Disable debugging and public API access for non-authenticated users.
🚀 Conclusion
This security scan highlights critical vulnerabilities that need immediate attention. By securing the headers, API endpoints, and admin controls, ArcBlock.io can prevent potential data leaks and unauthorized access.
3 replies
lol this totally wrong AI generated content
Most of the diagnoses actually turn out to be false negatives, thanks anyway!
This is a known issue and already on our roadmap.