Weblate: CSV Injection with the CVS export feature - Glossary

Hi, The "Download as a CSV" feature of Weblate does not properly "escape" fields. Here is more information about this issue: http://www.contextis.com/resources/blog/comma-separated-vulnerabilities/ Here is one method to reproduce this issue: 1 I can add new information in Glossary with a name...

Weblate: Email verification over an unencrypted channel

Hey guys, When registered for an account, the confirmation email sent out, has a http link refer the attachment and allows a man-in-the-middle attacker to take over the account. He can do the following: - Obtain the confirmation tokens while transmitting to the weblate infra and redirect the user...

Weblate: Running 2 accounts with a single email

Hi, While testing, I found a logic flaw which made me to make two accounts with a single email Reproduction Steps - You need 3 emails Gmail to be precise - Register 2 accounts with 2 different emails - On account 1, add a new email 3rd email using the Google Auth - Then delete the previous email ...

Weblate: Specify maximal length in translation

Hi, It would be nice if you limit the length in translation the same problem here https://hackerone.com/reports/223931. You can see the "spam" here: https://demo.weblate.org/translate/hello/master/gl/?sid=c8c733d6-2a6b-11e7-9c94-5254000d9bae&offset=3 Thanks...

Weblate: CSV export filter bypass leads to formula injection.

Dear Weblate bug bounty team, Summary --- The new filter can be bypassed using: %0A-3+3+cmd|' /C calc'!D2. python text = "%0A-3+3+cmd|' /C calc'!D2" def csvfilterbypass: if text and text0 in '=', '+', '-', '@': return "'" + text return text How can this be fixed? --- You need to escape and detect...

Weblate: Specify maximal length in new comment

Hi, I tried to put this new comment in a translation and I got error. Message: asjdk jsahd jkhsahdk jashkdsakdj asjdk jsahd jkhsahdk jashkdsakdj asjdk jsahd jkhsahdk jashkdsakdj asjdk jsahd jkhsahdk jashkdsakdj asjdk jsahd jkhsahdk jashkdsakdj asjdk jsahd jkhsahdk jashkdsakdj asjdk jsahd jkhsahdk...

Weblate: No Password Length Restriction leads to Denial of Service

Hi Weblate, I am trying to register for an account when I came across a page where the password was required to be set up. The url is https://demo.weblate.org/accounts/password where the password was to be created after one provides his or her initial details. There is no limit to the length of t...

Weblate: Setting a password with a single character

Hi!, Following my previous report, 223618, I could see that you made a change to the site which https://demo.weblate.org/accounts/password/ says Your password can't be too similar to your other personal information. Your password must contain at least 6 characters. Your password can't be a common...

Weblate: Access to completion page without performing any action

Hi!, This is much of a best practice as it doesn't have much impact on the user. But I believe you may want to know. After making a registration or on finalizing a password reset, one is redirected to a page, https://demo.weblate.org/accounts/email-sent/. I noticed that even without making any of...

Weblate: Open redirect in Signing in via Social Sites

Weak Authentication Leads to the Open redirection to Malicios Sites : Signing in via Facebook : + https://hosted.weblate.org/accounts/login/facebook/?next=///evil.com Signing in via Gmail : + https://hosted.weblate.org/accounts/login/google-oauth2/?next=///evil.com Signing in via Github: +...

Weblate: No Rate Limitting at Change Password

Hello Team, I found out that you didnt implement a Rate Limitting on Change Password. Scenario This Scenario is Limited. But some of Programs here consider this. Victim Forgot to logout his/her account in Cafe/Internet Computer Shops. Attacker saw the Account that it is not Logged out having a...

Weblate: Self XSS at translation page through Editor Link at demo.weblate.org

User input is not sanitized properly at Editor link causing self xss. Steps to reproduce 1 Navigate to https://demo.weblate.org/accounts/profile/preferences 2 Provide Editor link as javaScript:alertdocument.cookie;//confirm1; and click on Save 3 Navigate to English Translation page of the project...

Weblate: demo.weblate.org is vulnerable to SWEET32 Vulnerability

Cryptographic protocols like TLS, SSH, IPsec, and OpenVPN commonly use block cipher algorithms, such as AES, Triple-DES, and Blowfish, to encrypt data between clients and servers. To use such algorithms, the data is broken into fixed-length chunks, called blocks, and each block is encrypted...

Weblate: [hosted.weblate.org]Account Takeover

Hello Team, Steps to Reproduce: Go to Login Page Reset Your Password by Clicking Reset it. Put your email and answer the captcha. Go to your email and click your reset Link. You dont need to Change Your Password because you'll be logged in. Scenario Victim forgot to logout his/her Email Account o...

Weblate: Content Spoofing

Hello Team, Discover a Content Spoofing here: Visit This Link PoC: F179125...

Weblate: Null Password - Setting a new password doesn't check for empty spaces

Hi Again! As seen your website at https://demo.weblate.org/accounts/password/ Your password can't be too similar to your other personal information. Your password must contain at least 6 characters. Your password can't be a commonly used password. Your password can't be entirely numeric. I found...

Weblate: Notify user about password change

Hi, There is an issue with password reset functionality with Weblate: user is not receiving notification when he reset password. Good thing: when user change his info like profile update, password change. User get email notification for password change etc. Issue: user not always gets a...

Weblate: Abuse of Api that causes spamming users and possible DOS due to missing rate limit

Summary: In your sub-domain: http://demo.weblate.org , another endpoint doesn't have any rate limit on it to prevent spamming you by posting a lot of questions. Description: Spamming and Possible DOS is being possible due to missing rate limit on this endpoint. Request POST /accounts/email/...

Weblate: Missing DMARC on weblate.org

Summary Email spoofing is possible due to missing SPF/Dmarc Records. Similar to this report submitted to Hackerone itself: https://hackerone.com/reports/575 Steps to reproduce: 1- Go to https://emkei.cz A Fake Mailer 2- Set the from to parameter as [email protected] or any other name, and send...

Weblate: Abuse of Api that causes spamming users and possible DOS due to missing rate limit on contact form

Summary: In your sub-domain: https://demo.weblate.org/ , there's an endpoint that doesn't have any rate limit on it to prevent spamming you by filling the contact you form multiple times to bomb you with tons of emails. Description: Spamming and Possible DOS is being possible due to missing rate...