Weblate: Weak e-mail change functionality could lead to account takeover

Hi, Summary I have found a design issue on the e-mail change functionality offered by the "/accounts/profile" handler. In particular, the e-mail change functionality does not require the current user password to be completed. Since the e-mail could be used to reset the password of the account, an...

Weblate: Content Spoofing in error message

Hi Weblate, I found a content spoofing Steps to reproduce 1. Go to https://hosted.weblate.org/translate/debian-reference/translations/fr/?type=Sorry for the inconvenience we where having some trouble in our system because of some hackers, please don't log in for you to make safe of your credentia...

Weblate: Missing restriction on string size of Full Name at https://demo.weblate.org/accounts/register/

Hi there Vulnerability Title: During my regular testing, I have found that there was no restriction on the amount of text that can be inserted into a user's Full name field. Security Impact: When the text size was large enough the service resulting in a momentary outage in our non-production...

Weblate: Open SMTP port can let anyone send email from mail.chihar.com

An open SMTP port 587 can let anyone connect and send emails impersonating someone in your the company if he could enumerate the email addresses. POC - 1. I performed an nmap scan and was able to find an open port 587 for SMTP 2. I did a netcat connection to it and was able to run commands such a...

Weblate: Login using disconnected google account i.e login using old email id

there is vulnerability that allows loggin in using old email id i.e a disconnected google account attack scenario: 1: attacker has compromised google id of user 2:now user notices this and changes email id and removes previous authentication 3:but still attacker can login using disconnected googl...

Weblate: Open port leads to information disclosure

Open port 10022 leads to disclosure of open-ssh version and current Debian version being used. POC- 1. I performed an nmap scan nmap -A -T4 -p- weblate.org 2. I saw the port 10022 was open and I did a telnet connect to the port. 3. As soon as I did the telnet connect it returned me the openssh...

Weblate: hosted.weblate.org: X-XSS-Protection not enabled

Hi, X-Xss-Protection @https://hosted.weblate.org/ has not been set. This header is used to configure the built in reflective XSS protection found in Internet Explorer, Chrome and Safari Webkit. Valid settings for the header are 0, which disables the protection, 1 which enables the protection and ...

Weblate: Directory Listing

Proof Of Concept Navigate this domain: https://hg.weblate.org Some information Disclosure: https://hg.weblate.org/sumwars/Changelog.txt https://hg.weblate.org/kallithea-stable/Apache-License-2.0.txt Some software verison Thanks,...

Weblate: You can simply just use passwords that simply are as 123456

This may not be a issue but is a flaw for many websites because passwords should contain letters and characters like - and much more. Uppercase, lowcase. as it makes it much more secure it will be acceptable. this might scare your customers away feeling unsecure...

Weblate: CSRF - Changing the full name / adding a secondary email identity of an account via a GET request

SUMMARY ---------- Hello, I have found a CSRF request via the activation email that will change the full name of the targeted account. This vulnerability exists if the attacker registers a new account and then gives his activation link to someone else. If the victim uses the received activation...

Weblate: Improper Password Reset Policy on https://hosted.weblate.org/

Application should not allow the user to set the last 3-5 password in terms of secure design principles. It should give a warning or provide such avoidance while user is using repetitive usage of passwords. Repro: 1. Try to set same old password via Password Reset link. Fix: Application should...

Weblate: Insecure Account Removal

Hi Team, The removal of account is one of the sensitive part of a web application that needs to protect, therefor removing an account should validate the authenticity of the legitimate user, however i have found that when removing an account, the system did not require the user to input the accou...

Weblate: CSRF : Lock and Unlock Translation

Description : Attacker can force to victim for Lock and Unlock Translation. That HTTP Request : GET /lock/aptoide-uploader/strings/ka/ HTTP/1.1 Host: hosted.weblate.org Connection: close Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10123 AppleWebKit/537.36 KHTML,...

Weblate: CSV Injection with the CSV export feature

Step to reproduce : 1.go to https://hosted.weblate.org/dictionaries/aptoide-uploader/bn/add 2.add "=1+1" to Source and Translation filed F178723 3.now do CSV export 4.you can see all the cell is displayed as "2" which means the code is executed. Best Regad's, Jay Patel...

Weblate: Already Registered Email Disclosure

Hello, In the registration at https://hosted.weblate.org/accounts/register/ , I found that trying an already used email would inform the register that you are trying used one, so with a dictionary of emails a hacker can determine the emails of all users in database and use that in phishing. Note:...

Weblate: Activation tokens are not expiring

Hi Team, Domain: demo.weblate.org In this bug, maybe it is low risk but i have found a way to login any person to the attackers account, therefor when any user login to attackers account, the attacker can see the users activity on attackers account. The issue relies on the password reset. Stes to...

Weblate: CSRF : Reset API

Description : Attacker can force to victim for reset his API. That HTTP Request : GET /accounts/reset-api-key/ HTTP/1.1 Host: hosted.weblate.org Connection: close Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10123 AppleWebKit/537.36 KHTML, like Gecko...

Weblate: [demo.weblate.org] Stored Self-XSS via Editor Link in Profile

Hi, Input validation and/or sanitisation is not currently applied to the "Editor Link" in the user's Preferences. Consequently, it is possible to store a JavaScript payload which is stored and executes in the Weblate instance context. F178717 Steps to reproduce 1. Visit the above Preferences page...

Weblate: No expiration of session ID after Password change

If an user changes his password, the session persists and new session ID won't be created. POC - 1. Make any request and capture it using any proxy burp 2. Go to account settings and change the password. 3. Replay the captured request by changing any parameterusername or fullname 4. You get a...

Weblate: Open Redirect via "next" parameter in third-party authentication

Hi, It is currently possible to execute an open redirection attack via the next parameter with the inclusion of a triple-slash prefix. Proof of Concept Redirect URL https://demo.weblate.org/accounts/login/github/?next=///google.com After authenticating, the user will be immediately redirected to...