GoDaddy CSRF Vulnerability Allows Domain Takeover

Good find and nice writeup, but this disclosure timeline is pretty harsh!

> 01/17/15 [Saturday] Initial discovery and attempt to reach GoDaddy security.

> 01/18/15 [Sunday] Further attempts to reach GoDaddy security, finally received word there was no timeline for a fix.

That GoDaddy acknowledged the issue after only a day (over a weekend, no less) is impressive. Surely they deserve another few days to figure out a timeline for a fix.

> 1/19/15 [Monday] GoDaddy implemented CSRF protection for sensitive account actions.

Yeah, it's totally reasonable that they won't have a timeline the day they got the report. And if they fix it the next day, who cares that they didn't give an ETA? Clearly they had better things to do than reporting back.

Reddit discussion: https://www.reddit.com/r/netsec/comments/2sz6n0/godaddy_csrf...

I wonder if this vulnerability is in some way related to the Gigya.com domain takeover by the SEA happened in November.