Vanilla: Spoofing the redirect process using RTLO

Hi team, Description: I was testing this subdomain rinkerboats.vanillacommunities.com and after some search, I found this path url https://rinkerboats.vanillacommunities.com/home/leaving?Target=https://google.com/ which used to redirect the users to external websites now this is good because you...

HackerOne: Domain spoofing in redirect page using RTLO

Summary: Hello, Domains can be spoofed on redirect page using RTLO. Description Include Impact: Using http://[email protected] & RTLO method, i found a way where redirect page host detection can be spoofed Steps 1. Insert this on report Just Click Here 2. On click of link, it will redirect to...

HackerOne: Query parameter reordering causes redirect page to render unsafe URL

Hello hackerone team I want to report I bypass w/c lead to XSS but limited only for IE due to CSP block on chrome Here is the POC ------------------ https://hackerone.com/redirect?signature=c9304cadaeabca0bfb7b92503c0318da5c42a86b&url=http%3A%2F%2Fbuglabs.me&url=JAVASCRIPT:alert%09document.domain...

Nextcloud: RTLO character allowed in shared files

SUMMARY ------------- Hello, I have notices that you do not properly strip the RTLO right to left override character in the sharing page of the file, thus allowing someone to mask the real extension of a file and if the user downloads, then opens the file something may be executed on his machine...

Open-Xchange: RTLO character in file names

DESCRIPTION ------- Hello, I have noticed that you allow the RTLO Right-To-Left-Override character is not filtered from the names of the files saved to drive, or in the attachement names, thus allowing 2 things : 1. Someone sends a malicious file html or exe or something esle via email that...

Snapchat: RTLO char allowed in chat

Hey all, There seems to be no filtering of strange unicode characters such as U+202E which is an Right-To-Left-Override. I can send messages like "Hey check out my new song at example.com/songrtlo3pm.exe" and everyone would see the link as "example.com/songexe.mp3". Links that end with .exe are...