Liberapay: Missing back-end user input validation can lead to DOS flaw

Hello Team, Usually such kind of reports are out of scope, however I still would like to report you the business logic weakness that should be eliminated, at least from my point of view. Due to missing user input validation it is can lead to application unavailability. Details: During brief revie...

Liberapay: Anyone can register organization legal type as "Soletrader"

When Organization type is registered, two values are displayed : Business and Organization. When another value is provided, an error message is printed saying the Legal Type is wrong. This error message is not printed and request success when the value "Soletrader" is provided. The value...

Liberapay: Able to View other users income history

Hello, I found an IDOR that i was able to view income history of other users, Steps to reproduce issue, 1. Login into account and fire up Burpsuite 2. The got to profile page and click on view income history 3. Then you can see a request like GET /Liberapay/charts.json HTTP/1.1 Host: liberapay.co...

Liberapay: Unsecure changing password

I would like to report about changing the password. When you change the password it didn't require the current password. The scenario here is when you forgot to logout your account when you login on other device it is easy to takeover the account by changing the password of it. Impact Easy to...

Liberapay: twitter api access token leaked on github

sensitive token were leaked on GitHub page of liberapay . also mixpanel token was leaked TWITTERCONSUMERKEY=QBB9vEhxO4DFiieRF68zTA TWITTERCONSUMERSECRET=mUymh1hVMiQdMQbduQFYRi79EYYVeOZGrhj27H59H78 +TWITTERACCESSKEY=34175404-G6W8Hh19GWuUhIMEXK0LyZsy7N9aCMcy1bYJ9rI...

Liberapay: Phishing by Navigating Browser Tabs

Hi team, I was create a PR on github https://github.com/liberapay/liberapay.com/pull/1127 Details Opened windows through normal hrefs with target="blank" can modify window.opener.location and replace the parent webpage with something else, even on a different origin. While this doesn't allow scri...

Liberapay: Current CSP Policy chained with HTML Injection can lead to Data Exfiltration

Hi Team, Summary While reviewing the CSP headers for en.liberapay.com i noticed that img-src has a source set to which means any source on the internet. The following is found in the current CSP Header config. img-src blob: data: Description: If the site is vulnerable to HTML Injection its possib...

Liberapay: CSRF to make any user accept the invitation to the team

Description: The victim can be tricked into accepting the invite as a normal GET request is sent while accepting the request. Steps to reproduce Make an html page using the following code: click here Change" test" with your team mate. Impact The impact is low but still it can make a user to accep...

Liberapay: Origin IP found, Cloudflare bypassed

Hello team, during the initial assessment of your assets I've come across what seems to be the unprotected origin server for www.liberapay.com. Description The frontend currently resolves to ████ and ███, both owned by Cloudflare, which act as your reverse proxy and WAF. By correlating your SSL...

Liberapay: Authenticated reflected XSS on liberapay.com via the back_to parameter when leaving a team.

Poc : Click the cancel button its redirect to 3rd party site. Regards, techguy Impact This vulnerability could redirect users to the attackers websites for phishing attacks...