62 matches found
Malicious Package
Overview algolia-places is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid using algolia-plac...
Algolia: Information disclosure via a misconfigured third-party product
The researcher identified a misconfiguration in a third party product that could have been used to retrieve information about Algolia users. We fixed the issue and worked with the provider of the third party product who confirmed that this vulnerability had not been exploited. Disclosure of all...
Algolia: Web Cache Deception Attack (XSS)
@testingforbugs identified an issue related to web caching which could lead to XSS attacks...
Algolia: Directory traversal at https://msg.algolia.com
Hi, I was able to view the internal server files at https://msg.algolia.com. Please see the attached screenshots for proof. I have tried to reproduce from within firefox and internet explorer without much luck however if you need it I will try to come up with a work around. For reference the...
Algolia: Text injection on status.algolia.com
Hi Algolia team! I just found a text injection vulnerabilty in status.algolia.com/clusters . Please follow the steps below. Vulnerable URL status.algolia.com Steps to reproduce: Go to Vulnerable URL Add anything you want after the Vulnerable Url. POC LIVE POC F193293 Hope you fix it! Thanks! Sh3r...
Algolia: SAUCE Access_key and User_name leaked in Travis CI build logs
hello algolia team, I founded the SAUCE AccessKey and Username was leaked in Travis CI build logs of instantsearch.js product Line-249-&-250. This can be used to perform every API calls of sauce-lab.e.g Creating a Sub account. I created a test account for testing. sorry for this ; . You should...
Algolia: Reflected XSS
XSS triggered by specific search query that needed to be inserted manually into the impacted element. The issue was detected as part of ongoing penetration test and despite this report being later than the initial disclosure, bounty has been awarded. Thanks @Algolia , @adams for Fixing this Bug...
Algolia: [github.algolia.com] DOM Based XSS github-btn.html
Description === Vulnerable parameter: user Vulnerable script: https://github.algolia.com/github-btn.html Vulnerable code: js var params = function for var t, e = , o = window.location.href.slicewindow.location.href.indexOf"?" + 1.split"&", r = 0; r HTMLHTMLHTMLHTMLHTMLHTML&type=follow PoC 2 XSS f...
Algolia: Possilbe Sub Domain takever at prestashop.algolia.com
Hey Sir It looks like prestashop.algolia.com has a A record pointing to 178.62.8.144 But when you visit prestashop.algolia.com you see a page hosted by "BC WebSolution" and I couldn't find any relation with Algolia Now what's suspicious here is http://178.62.8.144/ also serves the content of "BC...
Algolia: Stored xss
Hi,i have found an stored xss which is reflected at https://www.algolia.com/explorer?index=getstartedactors&tab=explorer Steps to produce: 1 Go to https://www.algolia.com/explorer?index=getstartedactors&tab=explorer and add " as an attribute and keep it at top as in screenshot1 2 Go to...
Algolia: Stored XSS triggered by json key during UI generation
Stored XSS is triggred from Indices - Generate a UI Demo. Typing anything in the Primary, Secondary, Tertiary, Image or URL attributes for User Interface section. These text box have a drop down which displays the json keys during which XSS is triggered. Sample json for XSS would be "": "hello",...
Algolia: [github.algolia.com] XSS
Hello , i found a Cross-Site-Scripting in your github subdomain. All you have to do is to search in this input i attached input.PNG Search about ,,document domain'' Alert was executed , because you don't sanitize the query which comes from github Search about ,,svg onload'' - github.algolia.com...
Algolia: No Rate Limit In Inviting Similar Contact Multiple Times
There is not Rate limit in Inviting a similar contact Multiple times See the attachment for confirmation :...
Algolia: Stored xss
Hi ,i have found an xss issue here : https://www.algolia.com/explorer?index=test&tab=ranking Steps to reproduce : 1-Go to : https://www.algolia.com/explorer?index=test&tab=ranking 2-At the Attributes to index add this script :" and press enter . 3-Click save You will see that the xss has been fir...
Algolia: 2-factor authentication bypass
Hello aligola team, there are 2-factor authentication bypass while login Steps= 1.made 2-factor authentication in your account 2.login to your account 3.you will see that your account is already opened without do 2-factor authentication POC video attached Thanks...
Algolia: RCE on facebooksearch.algolia.com
While doing recon on Algolia, I found that the session secret for facebooksearch.algolia.com has been committed to a public GitHub repository. Since the Rails app running at facebooksearch.algolia.com is using CookieStore as the session storage, this means an attacker knowing the session secret c...
Algolia: API Key added for one Indices works for all other indices too.
Hi, I created one API key and restricted it to only one index by adding it and gave it right for creating record. Now this api can be used to add records in other indeces in same account. Screenshot is attached...
Algolia: PHP version disclosed on blog.algolia.com
Hi ON BLOG.ALGOLIA.COM PHP application version is disclosed in response header "X-Powered-By" POC is attached...
Algolia: text injection can be used in phishing 404 page should not include attacker text
Hello i want to report a text injection and a missconfiguration of the 404 page which can be used in phishing the bug exists at : https://www.algolia.com/test/%2f../It%20has%20been%20changed%20by%20a%20new%20one%20https://www.crowdcurity.com%20so%20go%20to%20the%20new%20one%20since%20this%20one...