Weblate: Full Name Overwrite on Third party login

Description After one might have logged in on a browser using the Third party login Google and have made changes to the account like the Full name. Making a third party login on another browser using the same email overwrites the Full name to the name on the email. One would know he is logged in...

Weblate: Improper validation of unicode characters still not fixed

As opposed to the fix on 229483, unicode characters are not still properly being validated on the username field. Screenshot showing this is attached below. Shuaib...

Weblate: Open redirect while disconnecting Email

Hi team, there is a open redirect end point when any account owner disconnect email accounts. He is redirected to some other domain. Vulnerable URL https://demo.weblate.org/accounts/disconnect/email/2354/?next=http://google.com POC Steps: Go to authentication tab. Disconnect Email account and...

Weblate: no captcha for register user and weak question attacker can spam email

hi in https://demo.weblate.org/accounts/register/ attacker can register with same email and if didnt click on confirm link attacker can make request with infinite loop so attacker can spam another email with your service question is so simple any bot that can read source can generate answer for i...

Weblate: API Does Not Apply Access Controls to Translations

Summary ======= The /api/ does not enforce access control on the translation files, allowing anyone to download full translation files. See the screenshot for an example project being viewed by an anonymous account that is configured to have no permissions. Description ======= On my local setup...

Weblate: Uploaded XLF files result in External Entity Execution

Summary: ======== Weblate users in the Translate group or those with the ability to upload translation files can trigger XML External Entity Execution. This is a well known and high/critical vector of attack that often can completely compromise the security of a web application or in some cases...

Weblate: Improper Cookie expiration | Cookies Expiration Set to Future

Hi Team, I have found at many instances or places from signup till getting logged into application in domain "demo.weblate.org" that session maintaining cookies such as csrf token and session id's expiration dates are set to future date. As part of secure session management one should prohibit or...

Weblate: CSP "script-src" includes "unsafe-inline" in weblate.org and demo.weblate.org

Weblate is using unsafe-inline in script-src csp headers which allows the use of inline resources, such as inline elements, javascript: URLs, inline event handlers, and inline elements. POC: HTTP/1.1 200 OK Server: nginx Date: Tue, 23 May 2017 10:49:15 GMT Content-Type: text/html; charset=utf-8...

Weblate: CSRF bypass ( Delate Source Translation From dictionaries ) in demo.weblate.org

Hello I've Found CSRF in https://demo.weblate.org Sending a POST request dictionaries will delate successfully steps to reproduce: 1. go https://demo.weblate.org/ and login into your account 2. now go https://demo.weblate.org/dictionaries/hello/sl/ 3. add new word, now delate it by CSRF i made tw...

Weblate: Weblate |Security Misconfiguration| Method Enumeration Possible on domain

Hi Team, I have found an instance in application where application is alllowing OPTIONS method to be processed in HTTP request from weblate.org and in response to my request i got the information that these methods are allowed by application server "GET, HEAD, OPTIONS" Ideally server should not...

Weblate: Weblate- Banner Grabbing-Ngnix Server version

Hey, I have found in the HTTP response header from docs.weblate.org, the nginx web server version is disclosed. Ideally application server responds back to users error message in customzied manner by not revealing any sensitive information about webserver or underlying components in applicatio...

Weblate: Option method enabled

Description HTTP OPTIONS method is enabled. Affected URL : https://demo.weblate.org/ https://weblate.org/en/ https://hosted.weblate.org PoC curl -X OPTIONS https://hosted.weblate.org -vv Output aku@galau:$ curl -X OPTIONS https://hosted.weblate.org -vv Rebuilt URL to: https://hosted.weblate.org/...

Weblate: Takeover of an account via reset password options after removing the account

Hi, The Reset password mechanism can't validate or authenticate an user properly. After removing a user account it's possible to takeover the user account by using reset password option. which is turn into takeover an account. Step to Reproduce: 1. Go to weblate 2. Remove your account from weblat...

Weblate: Password token validation in https://demo.weblate.org/

Hi team, I noticed that when requesting multiple reset links at https://demo.weblate.org/ all tokens are valid and can be used. In numerous applications the following policy is adopted as an additional security measure: - keep valid only that token with shorter lifetime last requested or -...

Weblate: Password Restriction

Hi Weblate, Hope you all have a good day! Its a minor issue, but hope you'll fix it. It seems like after changing password for example my current password is : mypassword1 And lets assume that the hacker got an access to my account, and me of course will change my password to ex. mypassword2...

Weblate: No notificatoin sent on email after account deletion.

Hi again, Description: As I reported in previous report about account deletion about without entering password 229904 I've just noticed that there's no email notification received after successfully removal of account. Fixation: User should be notified by email notification at his email after...

Weblate: Adding Email lacks Password validation

Affected URL: https://demo.weblate.org/accounts/email/ Issue: The account section of profile says: "You can add another email address on the Authentication tab." But there is no option of adding another email in Authentication. However, I was able to guess the above endpoint. The problem here is,...

Weblate: Rate Limit Issue on hosted.weblate.org

Hi, Rate limit issue exist in hosted.weblate.org. An attacker can able to send as many email as he want to the victim mail. The attacker can successfully bruteforce on any users mail account even when the rate limiting is enabled. Step to reproduce : 1. sign up and login to a hosted.weblate.org 2...

Weblate: Missing restriction on string size

Affected URL: https://demo.weblate.org/contact/?t=account Issue: I have found an issue similar to 223454. There is no restriction to number of character that can be send as email, username and other field. If any more information is needed feel free to contact me...

Weblate: Self-XSS can be achieved in the editor link using filter bypass

Description I saw the fixed issue in the https://hackerone.com/reports/223692 and i think i found another filter bypass. I noticed that we actually can use special keywords like %branchs, %files and %lines. So XSS can be achieved in this way: %branchs:alert1;//https:// if the branch will be named...