Malicious Package

Overview federalist-admin is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package...

Malicious code in federalist-uswds-jekyll (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0a5a5a502aee6be665ea3bfadc5907f9b1d1e7d7949e7ec1ea581d205524fb70 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3000 Malicious code in federalist-uswds-jekyll (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0a5a5a502aee6be665ea3bfadc5907f9b1d1e7d7949e7ec1ea581d205524fb70 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GSA Bounty: Cross-Site Request Forgery on the Federalist API (all endpoints), using Flash file on the attacker's host

We endorse sp1d3rs's summary! The PR fixing this ticket is here: https://github.com/18F/federalist/pull/1157 Thanks to the 18F team for the great experience, fast fix, and the bounty! The report details i requested the limited disclosure due to lot of sensitive info in the attachments and report...

GSA Bounty: federalist.18f.gov vulnerable to Sweet32 attack

The researcher noted that federalist.18f.gov allows use of the TLSRSAWITH3DESEDECBCSHA cipher, which is now marked as "weak" in SSL labs because of risks of MitM attacks given this vulnerability: https://sweet32.info/, which requires monitoring of a long lived HTTPS connection. We inherit this...

GSA Bounty: Race condition on the Federalist API endpoints can lead to the Denial of Service attack

Description Hello. I discovered that the Federalist API doesn't have rate limiting in place, and executes any amount of request to the endpoint in parallel mode. The impact Since you are using the cloud, and i can't test the production environment, impact is theoretical in this case - it can be a...

GSA Bounty: [IDOR] The authenticated user can restart website build or view build logs on any another Federalist account

Description Hi. I found an Insecure Direct Object Reference vulnerability on the http://192.168.119.128:1337/v0/build/ endpoint. F200108 When the user wants to restart the build, next request are sent to the endpoint: "site":,"branch":"master" where siteid is numeric ID of the site. However, this...

GSA Bounty: Double Stored Cross-Site scripting in the admin panel

Description Hello. I discovered a Stored XSS attack vector in the Custom Domain field POC & Reproduction steps 1. Login to the federalist and go to the some instance http://localhost:1337/sites//settings 2. Fill the Custom Domain field by the javascript:alertdocument.domain and Demo domain...

Hacker Breaks into Political Party's Video Conference System; Could Spy, too!

A critical flaw in the video conferencing software of the Quebec Liberal Party PLQ − a Canadian federalist provincial political party − allowed a user to spy on and hear the strategy discussions of the party at its premises and even access the live video camera feeds. But luckily, the unknown whi...