Weblate: API Does Not Apply Access Controls to Translations

Summary ======= The /api/ does not enforce access control on the translation files, allowing anyone to download full translation files. See the screenshot for an example project being viewed by an anonymous account that is configured to have no permissions. Description ======= On my local setup...

Weblate: Uploaded XLF files result in External Entity Execution

Summary: ======== Weblate users in the Translate group or those with the ability to upload translation files can trigger XML External Entity Execution. This is a well known and high/critical vector of attack that often can completely compromise the security of a web application or in some cases...

Weblate: Improper Cookie expiration | Cookies Expiration Set to Future

Hi Team, I have found at many instances or places from signup till getting logged into application in domain "demo.weblate.org" that session maintaining cookies such as csrf token and session id's expiration dates are set to future date. As part of secure session management one should prohibit or...

Weblate: CSP "script-src" includes "unsafe-inline" in weblate.org and demo.weblate.org

Weblate is using unsafe-inline in script-src csp headers which allows the use of inline resources, such as inline elements, javascript: URLs, inline event handlers, and inline elements. POC: HTTP/1.1 200 OK Server: nginx Date: Tue, 23 May 2017 10:49:15 GMT Content-Type: text/html; charset=utf-8...

Weblate: CSRF bypass ( Delate Source Translation From dictionaries ) in demo.weblate.org

Hello I've Found CSRF in https://demo.weblate.org Sending a POST request dictionaries will delate successfully steps to reproduce: 1. go https://demo.weblate.org/ and login into your account 2. now go https://demo.weblate.org/dictionaries/hello/sl/ 3. add new word, now delate it by CSRF i made tw...

Weblate: Weblate |Security Misconfiguration| Method Enumeration Possible on domain

Hi Team, I have found an instance in application where application is alllowing OPTIONS method to be processed in HTTP request from weblate.org and in response to my request i got the information that these methods are allowed by application server "GET, HEAD, OPTIONS" Ideally server should not...

Weblate: Weblate- Banner Grabbing-Ngnix Server version

Hey, I have found in the HTTP response header from docs.weblate.org, the nginx web server version is disclosed. Ideally application server responds back to users error message in customzied manner by not revealing any sensitive information about webserver or underlying components in applicatio...

Weblate: Option method enabled

Description HTTP OPTIONS method is enabled. Affected URL : https://demo.weblate.org/ https://weblate.org/en/ https://hosted.weblate.org PoC curl -X OPTIONS https://hosted.weblate.org -vv Output aku@galau:$ curl -X OPTIONS https://hosted.weblate.org -vv Rebuilt URL to: https://hosted.weblate.org/...

Weblate: Takeover of an account via reset password options after removing the account

Hi, The Reset password mechanism can't validate or authenticate an user properly. After removing a user account it's possible to takeover the user account by using reset password option. which is turn into takeover an account. Step to Reproduce: 1. Go to weblate 2. Remove your account from weblat...

Weblate: Password token validation in https://demo.weblate.org/

Hi team, I noticed that when requesting multiple reset links at https://demo.weblate.org/ all tokens are valid and can be used. In numerous applications the following policy is adopted as an additional security measure: - keep valid only that token with shorter lifetime last requested or -...

Weblate: Password Restriction

Hi Weblate, Hope you all have a good day! Its a minor issue, but hope you'll fix it. It seems like after changing password for example my current password is : mypassword1 And lets assume that the hacker got an access to my account, and me of course will change my password to ex. mypassword2...

Weblate: No notificatoin sent on email after account deletion.

Hi again, Description: As I reported in previous report about account deletion about without entering password 229904 I've just noticed that there's no email notification received after successfully removal of account. Fixation: User should be notified by email notification at his email after...

Weblate: Adding Email lacks Password validation

Affected URL: https://demo.weblate.org/accounts/email/ Issue: The account section of profile says: "You can add another email address on the Authentication tab." But there is no option of adding another email in Authentication. However, I was able to guess the above endpoint. The problem here is,...

Weblate: Rate Limit Issue on hosted.weblate.org

Hi, Rate limit issue exist in hosted.weblate.org. An attacker can able to send as many email as he want to the victim mail. The attacker can successfully bruteforce on any users mail account even when the rate limiting is enabled. Step to reproduce : 1. sign up and login to a hosted.weblate.org 2...

Weblate: Missing restriction on string size

Affected URL: https://demo.weblate.org/contact/?t=account Issue: I have found an issue similar to 223454. There is no restriction to number of character that can be send as email, username and other field. If any more information is needed feel free to contact me...

Weblate: Self-XSS can be achieved in the editor link using filter bypass

Description I saw the fixed issue in the https://hackerone.com/reports/223692 and i think i found another filter bypass. I noticed that we actually can use special keywords like %branchs, %files and %lines. So XSS can be achieved in this way: %branchs:alert1;//https:// if the branch will be named...

Weblate: Information Disclosure on demo.weblate.org

Description The demo instance, located on https://demo.weblate.org is leaking user's IP-adresses in the Activity log. F185728 Impact The authenticated user can disclose valid IP adresses of other users through Activity log. The feature works as it should so no changes should be made on the GitHub...

Weblate: Captcha bypass at registration

Affected URL: https://demo.weblate.org/accounts/register/ Issue: The captchas are implement so that the site can differentiate between the legitimate user and the bot. The captcha challenge should be something that a bot cannot solve easily and a human could easily solve. However, in the above UR...

Weblate: Old password can be new password

Affected Domain: https://demo.weblate.org/ Issue: The sites like Facebook and Google keeps tracks of old password and does not allow user to set password similar to their old passwords. However in case of demo.weblate.org. It is possible for a user to set new password which is exactly similar to...

Weblate: Captcha Bypass at Email Reset can lead to Spamming users.

Because of 223525 you've implemented captcha on Reset Email functionality. But it can be bypassed and any attacker can flood/spam victim with reset emails in his Email Inbox...