Trello: Can run arbitrary script on em.trello.com

It was possible to cause arbitrary content and script to be served on em.trello.com. While this didn't directly compromise user data, this behavior could be used as part of a phishing attack. While em.trello.com is not normally in scope for our bug bounty program, this issue was severe enough tha...

Trello: XSS on blog.trello.com

Hello, I wasn't really sure if this was in the scope but I thought I'd report it just to be sure you guys can patch it or update your Wordpress plugin. You are using a XSS vulnerable WP plugin PoC:...

Trello: Unvalidated/Open Redirect allowing attackers to implement phishing attack

Poc: 1.Edit the HTTP request of https://trello.com in BURP SUITE: Edit the HTTP REQUEST to: GET //www.attacker.com/%2f%2e%2e HTTP/1.1 Host: trello.com HTTP Response HTTP/1.1 303 See Other Cache-Control: no-store, no-cache X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=15768000...

Trello: SSRF in account webhook (through API)

It was possible to create a webhook that pointed to the EC2 metadata address, http://169.254.169.254. While no data from that address would be returned, the webhook would be created successfully with a 200 status, indicating that proxy used by the webhook requests wasn't blocking access to that...

Trello: Security code not getting invalidate on requesting New

As per you have rate limit set on 6 times requesting verfication code request 6 verification and put the verification code which was send to u in first sms will be accepted by server. even after first sms all 5 sms is sent by server to mobile . On the request of new authenticaton code old one...

Trello: File access using image tragick

While Trello had patched our image libraries to prevent the RCE vulnerability in ImageMagick, we had not applied a patch to prevent arbitrary file reads via labels in mvg files. After resolving the issue, we were able to determine that no files had actually been accessed using this vulnerability,...

Trello: XSS and Open-Redirect via SVG

Hi Trello, When I was uploading image attachments from my computer,I've realized that I can upload SVG files and then I've tried to look SVG file that I attached,and I understood you execute SVG files which is can be malicious redirecting to a website or executing javascript codes for members...

Trello: Verification Code Reused For activating 2FA

There is Authentication Problem with the Verification Code for Activating 2FA ! Description: Verification Code is getting reused for multiple times aven on every activation 2FA action there you recieve saperate an new Verification Code for Activating 2FA ! Proof Video thanks...

Trello: Sending Unlimited Mails To Anybody With Easy Social Share Buttons Plugin

Hi, I want to talk about your ESSB plugin.When I was doing a research about it I saw that link " http://blog.trello.com/wp-content/plugins/easy-social-share-buttons3/public/essb-mail.php " When you navigate that link it says "message":"Error sending message!" But when you put the right parameters...

Trello: XSS in Jetpack plugin

Hey, It seems like you are using an unpatched Jetpack version. Your changelog says so http://blog.trello.com/wp-content/plugins/jetpack/changelog.txt It is known to be vulnerable to XSS Check it https://jetpack.com/2016/05/27/jetpack-4-0-3-critical-security-update/ Please update your plugin. Than...

Trello: Error Page Text Injection.

AS we can see in report an user or attacker is able to inject his text into error page and can trap to user to visit other site by adding following link /test/%2f../It%20has%20been%20changed%20by%20a%20new%20one%20https://www.malicious.com%20so%20go%20to%20the%20new%20one%20since%20this%20one A...

Trello: Cross site scripting in blog.trello.com

This is a cross site scripting vulnerability issue found in POST based method payload : post method service is set to be "alert1 vulenrable url : http://blog.trello.com/wp-admin/admin-ajax.php?action=essbselfpostcount&nonce=4ae59c16bc&postid=2460&service="alert1 Change this get request to post...

Trello: Using WebSocket I can always access organization data even if I am removed

When a user is a member of a team, they are allowed to connect to an update channel that sends them notifications when the team changes. There were some cases where a team member might receive an update that included the name of board that was in their team … even if they weren't a member of that...

Trello: DOM based XSS via Wistia embedding

Hi, You are using Wistia to embed video at trello.com. However external script from fast.wistia.com vulnerable to XSS and allows to run malicious javascript on your side. vulnerable code: fast.wistia.net/assets/external/E-v1.js I found that parameter wchannel can be controled to load js from...

Trello: Normal User can add new users to group

A normal user does not have privilege to add new members to a group. But adding following HTML button Payload, a Normal user can add new members to a group which he did not have privilege to perform Payload: Add Members Steps To Reproduce: 1. Login to Trello https://trello.com/login 2. Navigate t...

Trello: [blog.trello.com] CRLF Injection

PoC: https://blog.trello.com/%0aSet-Cookie:CRLF=INJECTION;domain=.trello.com HTTP Response: HTTP/1.1 301 Moved Permanently Server: nginx Date: Wed, 28 Jan 2015 10:47:51 GMT Content-Type: text/html Content-Length: 178 Connection: close Location: http://blog.trello.com/...