Visafi's visa bot was taking orders from the whole internet

Two servers wearing one coat

From the outside, visafi.com looks like one website. It is two. The thing you type into is a front-end on a plain VPS. When you request a visa, that front-end does not process anything itself; it forwards your details to a second machine on AWS, where the actual work happens.

We noticed the split the boring way: by watching our own traffic. Submit the public form, intercept the request on the way out, and the response makes it obvious the VPS is just a messenger passing everything to a backend that lives somewhere else. That backend is the brain. It is also where it stops being a normal website.

What the brain does is automate. A real visa application is a tedious government web form, so Visafi built a bot to fill it in: a browser, driven by software, typing the applicant's data into the official site on their behalf. The tool for that job is Selenium, and Selenium needs a hub.

Port 8080, come on in

A Selenium Grid hub is the control plane for those browser bots. It hands out browser sessions, drives them, and collects the results. It is powerful by design, which is exactly why it is supposed to live somewhere private, reachable only by the backend that owns it.

Visafi's hub was on the public internet, on port 8080, answering to anyone.

GET http://[REDACTED]:8080/wd/hub/static/resource/hub.html

200 OK
Selenium Grid — console

No authentication of any kind. The hub that drives Visafi's automation was taking instructions from whoever sent them.

What an open hub actually means

This is not a leaked file or a misconfigured header. This is remote control of real browsers, running on Visafi's own AWS machine, offered for free to the internet.

Anyone who found that port could create their own browser sessions on their infrastructure, as many as they liked, originating from Visafi's IP. That alone is someone else's compute, someone else's reputation, pointed wherever the requester fancies.

It gets worse, because browsers do not only open https://. They open file://. A Selenium node told to navigate to a local path will happily load it and read it back, which turns a browser-automation service into a window onto the host's own filesystem. And a browser on that box can reach whatever that box can reach: the internal services, APIs and databases sitting behind it that were never meant to see a request from outside. An open hub is a foothold with a steering wheel attached.

Everything the automation machine could touch, the open hub could be pointed at. The only thing standing between the public internet and that control plane was the hope that nobody would scan port 8080.

The short version

A visa platform built a robot to fill in government forms, gave the robot a public IP, and left the door to its control plane open on 8080 with no lock.

The fix is one line of firewall config. The exposure is the kind that does not need a vulnerability, a CVE or an exploit. It needs someone to bind a service to the wrong interface, and nobody to check.