[Security] Sender can reveal Agents IP without user interaction
Hi,
I'm a little bit frustrated here. I reported a security issue (in my eyes) to the bug-bounty program of Zoho. But it's being refused and the judgement is: "No security issue" . So that's why i'm publicing it here, curious what other people think about this.
The outline is that someone can mail our support desk and can get the following information:
- IP of the Agent (re)opening the ticket
- this IP is valuable information for hackers because it might be an Office or VPN ip
- The IP might reveal the location of an agent, depending how accurate the IP database is
- timestamp of ticket being opened
Just by using an img tag in the mail.
To make things clear:
- I do not care about getting a bounty; I care for my agents and our organisation security
- It's not about the agent is manually opening a link in a ticket, it's about opening links without user interaction.
- Zoho has read-receipt disabled by default. Obviously because of privacy reasons ..... This issue provides even more info then a read-receipt.
Some possible solutions:
- Zoho will sent all remote requests over a proxy. Gmail also does this, so you only see an Google ip address in the access log
- When ticket is created, add the image as base64 or something like that, so it won't be requested by http
- Make an option to disable this behaviour
My original report:
Hi,
|
Access your files securely from anywhere
Zoho Developer Community
New to Zoho LandingPage?
Zoho LandingPage Resources
New to Zoho Survey?
New to Zoho CRM Plus?
Deliver unforgettable customer experiences
New to Zoho CRM Plus?
Deliver unforgettable customer experiences
New to Zoho Marketing Plus?
Everything you need to run your marketing
New to Zoho Marketing Plus?
Everything you need to run your marketing
New to Bigin?
Topic Participants
Gerwin
Shivani | Zoho Desk
Sticky Posts
Live Webinar - Work smarter with Zoho Desk and Zoho Workplace integration
Hello customers! Zoho Desk and Zoho Workplace are coming together for a webinar on 14th May, 2024. Zoho Workplace is a suite of productivity apps for email, chat, docs, calls, and more at one single place. Zoho Desk is closely integrated with a few toolsApple iOS 17 and iPadOS 17 updates for Zoho Desk users
Hello Zoho Desk users! Apple recently announced the release of iOS 17 and iPad OS 17. These latest OS updates will help you stay productive and efficient, through interactive and seamless user experiences. Zoho Desk has incorporated the updates to helpZoho Desk Partners with Microsoft's M365 Copilot for seamless customer service experiences
Hello Zoho Desk users, We are happy to announce that Zoho Desk has partnered with Microsoft's M365 to empower customer service teams with enhanced capabilities and seamless experiences for agents. Microsoft announced their partnership during their keynoteZoho Desk Cheat Sheet For The Year-End
Check out these Zoho Desk best practices to end this year on a high and have a great one ahead! #1 Set Business (Holiday) Hours - If you have limited working hours, please make sure you restrict your business hours or set them as holidays for the coming days. Let your customers know when you will, and won't, be available. #2 Update the Annual Holiday List - Check the holidays for the new year and update the holiday schedule. Usually, holidays from the current year will be carried over for the nextDeprecation of older versions of ASAP Mobile SDK | Zoho Desk
Hello, everyone. Greetings from Zoho Desk ASAP! In order to continue to deliver the best and most secure experience to our mobile SDK users. On account of the recent enhancements and updates to the mobile SDKs, we have planned to mark the older versions
New to Zoho TeamInbox?
Zoho TeamInbox Resources
Zoho DataPrep Resources
Zoho CRM Plus Resources
Zoho Books Resources
Zoho Subscriptions Resources
Zoho Projects Resources
Zoho Sprints Resources
Qntrl Resources
Zoho Creator Resources
Zoho Campaigns Resources
Zoho CRM Resources
Design. Discuss. Deliver.
Zoho Show Resources
Get Started. Write Away!
Writer is a powerful online word processor, designed for collaborative work.
Zoho CRM コンテンツ
-
オンラインヘルプ
-
Webセミナー
-
機能活用動画
-
よくある質問
-
Ebook
-
-
Zoho Campaigns
- Zoho サービスのWebセミナー
その他のサービス コンテンツ
Nederlandse Hulpbronnen
ご検討中の方
Recent Topics
Leads and Deals Issue
Hi! Is Zoho having trouble today? I've been experiencing issues today. When I move a deal to closed/won, it previously would require a closing date but today the screen just went blur and the closing date did not pop up. And then under leads, I was tryingQR codes in templates
I'm excited about the new QR code generator. I have included a QR code that contains the record ID setting "${ID}" as input data. In the report detail it works perfectly but when printing it in a template the code is not shown.How do I hide all leads from Standard users in my CRM ZOHO
I want to configure my crm zoho in such a way that standard users will only see leads owned or assigned to them. How do I go about doing this? I have tried all i could, but nothing...can anyone help me?Custom view for Milestones
Hi, Just an idea for the future... would it be possible to create custom views for the Milestones view under Work Overview ? I usually need to look at this view filtered by project group but the filter doesn't remain when navigating away. A custom viewattributed automatically database section
Hello everyone and happy holidays... here in zoho CRM, I created 3 bases: - Properties (House, apartment ...) - Transactions (Notaries, ...) - Real estate ads I want when the address is identical on these three bases, that in "Properties" the transactionsHow to Implement Time-Based Filters in Zoho Workflows?
Hi everyone, I’m looking for a workaround to implement time-based filters in Zoho workflows. Specifically, I need a workflow to trigger only within certain hours (e.g., between 10:00 AM and 8:00 PM, Sunday to Friday). Currently, Zoho workflows executeis there a better way to routinely export my project timesheets?
Hi there, I am somewhat happy with how Zoho books handles time. One thing that is missing is more user driven control over my data. I have a workflow where I constantly need to give customers feeds of work done. So I pick a project, and would ideallyPortal Default View
Hello! My company is about roll out portals for some users, but we were wondering if it was possible to set the Record Detail Page View to default to a custom view that we made. That way the information they need would be streamlined and easier to see.Zoho Books API Limit Is RIDICULOUS!!!!!!!!!!!!!
The 2,500 API call limit in Zoho Books is about as useful as AOL dialup. Seriously Zoho, not only can I use up 2,500 API calls in no time with my own app but YOUR OWN STUPID IPAD APP blows through them super fast too, so if any one of my clients wantsUnlocking New Horizons: A Year in Review
As we bid farewell to 2024, let's celebrate and revisit the key highlights of the year. From adding a new edition to cross-platform enhancements, here’s a roundup of all the feature updates designed to simplify accounting, optimize financial management,Does zoho rest api support token exchange from microsoft entra id token
i want to get access token from the Microsoft user token in rest api. so it is possible to exchange microsoft user access token to zoho's access token or auth token ( token should be user specific not super admin).Important: DKIM verification needed for unauthenticated email domains
Hi all, This post is to inform users who are currently using unauthenticated email domains as their sender email for their notifications. We have mandated DKIM verification for all domains used as sender email addresses for the outgoing emails by 01-Jan-2025.How do I define a weekend
I noticed the default for weekends does not seem to include Saturdays. How can i define weekends to include both Saturdays and Sundays? Thank you.Custom Status for Purchase Orders
Currently Zoho books has functionality to create custom statuses for Sales Orders. Can this be extended to include custom status for purchase orders as well? It was a great decision to add this functionality to sales orders. Our use case is for trackingRemove Address from credit card payment
I would like to remove the need to add address when paying by credit card. I only want the customer to have to add their credit card details.Top Menu Disappeared from Blog Page
Hi, Our top menu disappeared at Blog Posts page. However, it's still visible any other page on the website. I attached two screenshots, so it can be understood clearly. How can we bring back top menu? Thanks, K.Subforms and automation
If a user updates a field how do we create an automation etc. We have a field for returned parts and i want to get an email when that field is ticked. How please as Zoho tells me no automation on subforms. The Reason- Why having waited for ever for FSMMy Zoho mail has been blocked for suspicious activity. cannot unblock it! need urgent help!
Hi, I was accessing my email on an airplane which for some reason resulted in my mail being blocked. I have managed to unblock my incoming however outgoing is still blocked. I have contacted all your support emails but it still says contact support when I try to unblock outgoing emails. Its now been over 8 days with the same issue which is really serious as I'm not able to send several business emails during this period. I have followed all your steps to unblock this and contacted your support 5Copy Widget to another Dashboard
I can see the option to clone a widget to the same dashboard but is it possible to copy it to another dashboard?booking link that expires
I have a suggestion that is crucial. When i send booking URL to clients they keep the link and they book appointment whenever they want multiple times. You should give us the Booking URL feature. We should be able to send it and the user can use it onlyError while importing products Purchase Price: Value in the field does not match with the data type supported by us.
I am trying to import items into zoho inventory using an excel spreadsheet. I keep getting this error Purchase Price: Value in the field does not match with the data type supported by us. no matter how i format the cells this comes up and will not importQuotes Module - import data
Hello Zoho, is it possible to import Quotes records? I was trying and i have no results. Raport shows no data imported. Could you help me please how to do it?Year-End Wrap: Disconnect now; Reconnect later with Offline Mode
🎄Happy Holidays🎄 Let's say you are travelling home to spend the holiday season with your loved ones. Before you even board the train, you check your phone only to find your inbox rapidly filling with urgent emails that need your attention. There’s noExploring SalesIQ's Top Features of 2024: An Insider's Look 🔍
As we wrap up another year at Zoho SalesIQ, it's time to reflect on how far we've come. This year has been incredible for us in our journey to build a more powerful, flexible, and customer-centric engagement platform. We've introduced several featuresResource booking functionality questions
I'm exploring the resource booking functionality in Zoho Bookings for my organisation's needs. I have a few questions about the available Zoho Bookings functionalities. Is it possible to force all users to sign up for an account before they book a resource?How to create a Field with answers as Yes, No> Further if no is selected a new field to be visible to give details
Dear All, I am creating a feedback form in HR Letter. The question is were you satisfied with the work allotted. Expected answer to this is Yes, No. Further if the response is no, then a field to be give to fill more details as to why no was selected.Modify the way a phone number is shown in footer on ZOHO Booking Page
The default display of the phone number field in the footer is not customer friendly - See image below. We would like it to use the accepted standards of phone number display: +61 (0)2 88545440, or allow us to choose. At the moment ZOHO Booking sets howZoho Bookings Multilingual ?
Hello, Not sure if there is a way to do it currently, but it would be very helpful if Zoho bookings allowed multilingual translations so we could have our booking pages and notifications setup in multiple languages. Thanks,Allow customers to choose meeting venue and meeting duration on booking page
My business primarily involves one-to-one meetings with my clients. Given the hybrid-work world we now find ourselves in, these meetings can take several forms (which I think of as the meeting "venue"): In-person Zoom Phone call I currently handle theseProblem viewing document imported from google drive.
Hello, When I add a document via my google drive, it is impossible to preview it. I get the error “Files without extensions cannot be previewed. Download to view this file”. Could you please help me? Also, and this is more of a question: is there a wayTwo way sync Zoho Mail and Bookings
Hi, I know it’s possible to view Bookings appointments in Zoho Mail, but is there a way to see my Zoho Mail meetings in the Bookings calendar?Modifying iframe data of Zoho booking iframe
Hello, I have integrated a Zoho Bookings embedded iframe into my website. Currently, I am pre-filling the booking form with default values as part of our process flow. However, I want to ensure that if an input field is already populated with a defaultSending my emails to Spam Folder
I am loosing my business because of this issue, many of my customers are receiving their email in the spam sometimes no one checks themWhy can't I sync my Zoho Mail tasks and notes with my mobile device, and is there a way to fix this issue?
I'm having trouble syncing my Zoho Mail tasks and notes with my mobile device. Despite following the usual steps, the tasks and notes don't appear on my phone. Is there a way to fix this issue? Regards, Adamjes, Tekskills India Pvt Limited, India.Re: constant rejected email form and to my account
Hi, have had several rejection when I sent an email to Zoho account as well as other people have sent emails to my as your health Centre they have account and all aspects have been ejected. i wonder why the email are rejecting to and from. If you seeHow do I redeem credits?
How do I redeem credits that are shown in billing section?Introducing 'Queries' In Zoho CRM
Hello everyone! We are here with an exciting feature - Queries in Zoho CRM! A little context before we dive right into the feature specifics :) In today’s fast-paced business environment, immediate access to relevant data is essential for informed decision-making.Will zoho thrive be integrated with Zoho Books?
titleCannot add IMAP account to "new" Outlook
Hi, I am attempting to add an IMAP account to my copy of the "new" Outlook on my desktop computer. I have tried using the default password when MFA was disabled and an app password when MFA was enabled. But neither attempt worked. My Windows 11 OS numberUpdate Zoho Flow on Sprint Work Item Status Change
Hello, I've contacted Zoho One support but have been unable to help in a timely manner, so I'm asking the community. I want to start using sprints, but I'm having an issue. I need to post updates to Slack when a Work Item has a status change. My understandingNext Page