The websites of the „Aachener Zeitung GmbH“ are offering a mixture of free and payed articles hidden by paywall at http://www.aachener-zeitung.de/zva/pc/. The websites use AESUtil and CryptoJS to hide articles.
The provider leaks sensitive data like password, IV and salt which are used for encryption and can be used to decrypt the articles with
decrypt = aesUtil.decrypt(salt, iv, passPhrase, cipherText);
This issue does not leak any personal data of (registered) users.
- Reported to https://www.facebook.com/azlokalesaachen/
- responsible disclosure until 04.08.2017
