Semrush: OAuth `redirect_uri` bypass using IDN homograph attack resulting in user's access token leakage

Issue Summary: It was found that SEMrush OAuth implementation fails to properly validate the value of redirecturi parameter which was bypassed using IDN homograph attack which results in leaking the user's access token to an attacker-controlled domain name. IDN homography attack exploits the fact...

Semrush: IDOR in the https://market.semrush.com/

Insecure direct object references in marketplace due to a length restrictions in chosen hashing function...

Semrush: IDOR in marketing calendar tool

INTRODUCTION I used two accounts to search for this vulnerability: Id: █████ Email: ██████ Id: ███ Email: ███ IP used: 78.194.169.36 Endpoint URL: https://ec.semrush.com/api/v1/ga/userstatus/?calendarid=CALENDARID EXPLOITATION Description of Security Issue: When a marketing calendar is loaded in...

Semrush: SSRF and LFI in site-audit tool

SSRF and LFI vulnerability in Site Audit due to lack of connection protocol verification...

Semrush: Reflected XSS on https://www.semrush.com/my_reports/externalSource/callback/googleAccountsGMB

Researcher found reflected XSS vulnerability on https://www.semrush.com/myreports/externalSource/callback/googleAccountsGMB Report: The parameter status is missing sanitization in the following url: https://www.semrush.com/myreports/externalSource/callback/googleAccountsGMB?status=xssalert//...

Semrush: IDOR in semrush academy

INTRODUCTION I used two accounts to search for this vulnerability: - id: 5410425 email: ████[email protected] - id: 5407773 email: ████@anosimple.com IP used: ███ Endpoint URL: https://www.semrush.com/academy/courses/userEnroll EXPLOITATION Description of Security Issue: When a user clicks on the...

Semrush: An attacker can buy marketplace articles for lower prices as it allows for negative quantity values leading to business loss

Hi there, When we Summary: When someone goes to https://www.semrush.com/marketplace/offers/ and orders for articles, an attacker can pay for less than intended due to negative quantities being allowed. Steps To Reproduce: - Go to https://www.semrush.com/marketplace/offers/ - Click on 500 Words$40...

Semrush: CORS misconfiguration which leads to the disclosure of certain data concerning the user.

INTRODUCTION I used an account to search for this vulnerability: id: 5407773 email: [email protected] IP used: 2a01:e34:ec2a:9240:7d25:26c3:1449:bfe7 endpoint URL: https://www.semrush.com/content-paywall/api/accesslevel Summary: CORS policy too permissive. EXPLOITATION Description of...

Semrush: Content Injection on api.semrush.com to Reflected XSS

The researcher found XSS vulnerability and wrote an awesome summary! : While testing api.semrush.com I've found that some inputs triggered MongoDB error on /reports/v1/projects/:id/siteaudit/page/list endpoint. Contents of url parameter was reflected in error message. Unfortunately WAF blocked my...

Semrush: Unrestricted file upload in www.semrush.com > /my_reports/api/v1/upload/image

@zcashi found vulnerability in My Reports Tool. You can read the full write-up here: How I earned 500$ by uploading a file: write-up of one of my first bug bounty...

Semrush: Code injection in https://www.semrush.com

INTRODUCES: -With a direct error on the homepage, it is easy to trick the victim into accessing a fake page from the attacker STEP: Step: Send url with payload to victim:...

Semrush: Open redirect in semrush.com

Summary: There is an open redirect on https://www.semrush.com/login/?redirectto=. By using /\ at the start of the link, you can bypass the open redirect filter. Description: An attacker can control the value of the "redirectto" parameter and make it redirect to a malicious endpoint. Steps To...

Semrush: Github information leaked

Researcher has found the third-party repository with test data for internal services development...

Semrush: Manipulation of exam results at Semrush.Academy

The researcher was able to bypass the exam process. By replacing the exam results with the correct ones, as the body of the request was JSON. After sending the request with the correct results, the researcher received a certificate. Hi. In this situation, it was possible to bypass the exam proces...

Semrush: SSRF In Get Video Contents

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to verify and then potentially issue a bounty, so be sure to take your time filling out the report! Summary: A SSRF In Get...

SEMrush Plugs Remote Code Execution Bug in Its SaaS Platform

UPDATE Search engine optimization and analytics firm SEMrush patched a remote code execution vulnerability that allowed an attacker to send a malicious image to its service and generate a reverse shell, a typical first stage in a cyberattack. Public disclosure of the vulnerability was Monday when...

Semrush: XSS Reflected on my_report

Еще раз привет. На этот раз, кроме HTML-инъекции проходит полноценный XSS в дашбоарде пользователя. Payload: https://www.semrush.com/myreports/api/v1/document%22%3E%3Cimg%20src=x%20onerror=alertdocument.cookie%3E/4007861 PoC: На скрине Impact Кража сессионных куков...

Semrush: Persistent CSV injection

Hi Team, https://www.semrush.com/notes is vulnerable to persistent csv injection stored csv injection POC: 1 Login into application and open https://www.semrush.com/notes 2 click on "Add note" button 3 And enter csv injection payloads like =4+4, =HYPERLINK"http://evil.com", "EVIL" and click on sa...

Semrush: protocol & Ports are not shown in third-party site redirect warning page

Summary: protocol & Ports are not shown in third-party site redirect warning page Vulnerable Endpoint :- https://www.semrush.com/redirect?url=ftp://evil.com:1337 Description: I noticed 311330 this report where you guys fixed a open redirect report by adding a external third-party site redirect...

Semrush: Remote Code Execution on www.semrush.com/my_reports on Logo upload

The Logo upload in the report constructor at: https://www.semrush.com/myreports/constructor F340480 is passed through a not properly patched version of ImageMagick. You can use Postscript to get Ghostscript to run which in return allows to trigger arbitrary commands on the server, leading to Remo...