h1-ctf: HackyHolidays H1 CTF Writeup

HackyHolidays Day 1 Once the CTF started and the Grinch released the scope hackyholidays.h1ctf.com, I started the CTF by a good old Nmap scan, to see whats running on the server. So the nmap command looked like nmap -sC -sV -oA nmap hackyholidays.h1ctf.com/. The result showed a promising entry...

Shopify: XSS stored in the Shopify Email app

step: 1、install app Shopify Email F1076928 2、Click General under Settings 3、Change phone number to 1234567" F1076939 4、Open shopify email app and create an email 5、Show phone number F1076940 6、watch the vedio poc for more information Impact store xss...

BugPoC: Solution for XSS challenge wacky.buggywebsite.com

Summary: Found a HTML injection in https://wacky.buggywebsite.com/frame.html?param=Injected Bypasswing CSP : CSP : script-src 'nonce-txjohfomwjdo' 'strict-dynamic'; frame-src 'self'; object-src 'none'; Then found a vuln code in https://wacky.buggywebsite.com/frame.html js window.fileIntegrity =...

Ubiquiti Inc.: Unauthenticated request allows changing hostname

We have recently released new version of UniFi Cloud Key firmware that fixes a vulnerability found on v1.1.6 and prior for Cloud Key gen2 and Cloud Key gen2 Plus, according to the description below: Unauthenticated API requests allow changing device hostname. Affected Products: UniFi Cloud Key Ge...

Razer: AWS subdomain Takeover at estore.razersynapse.com

The tester discovered the razersynapse.com domain was vulnerable to a subdomain takeover. Although this is out of scope of our program, we appreciate the tester bringing this to our attention...

Stripo Inc: Redirection through referer tag

Summary: I replaced the referer value https://stripo.email/de/ with www.google.com and it worked, it redirected me to google.com Steps To Reproduce: 1. Open URL https://stripo.email/de/subscribe/ 2. Intercept with BurpSuite 3. Change the parameter value of referer and insert any domain you want i...

Kartpay: bypass captcha in the form forgot password

Summary: In this issue I can bypass Captcha Protection in the Forgot Password form. Browsers Verified In: firefox url: https://affiliate.kartpay.com/ url vulnerable: https://affiliate.kartpay.com/forgotpassword Steps To Reproduce: 1-Enter your email in the forgot password parameter. 2-complet...

Node.js third-party modules: [reveal.js] XSS by calling arbitrary method via postMessage

I would like to report XSS in reveal.js It allows gaining access to the victim's account and performing actions on his behalf Module module name: reveal.js version: 3.8.0 npm page: https://www.npmjs.com/package/reveal.js Module Description A framework for easily creating beautiful presentations...

U.S. Dept Of Defense: Root Remote Code Execution on https://███

Summary: Atlassian Crowd is a centralized identity management application that allows companies to "Manage users from multiple directories - Active Directory, LDAP, OpenLDAP or Microsoft Azure AD - and control application authentication permissions in one single location." A DOD installation is...

WakaTime: password token validation

Hello, when I reset password all tokens are valid can be used, should keep valid only token in the last request or you can invalidate all reset links after using one of the requests successfully. Steps: 1 go to the password reset page and request more than one request. 2 go to your email and use...

Pornhub: I am because bug

I'm because I hacker found bug because I report this bug I want to report a bug and because want some $$$$ so please because you are telling me how much you pay money so I give you bug. Me because very poor :' want money because father :' F181917 Thank you wish you because pay lots $$$$$$$$...

Uber: Authentication bypass on auth.uber.com via subdomain takeover of saostatic.uber.com

Summary This is not a standard vulnerability, but a chain of two more exotic vulnerabilities leading to a full authentication bypass of your SSO login system at auth.uber.com via saostatic.uber.com. The root cause of this authentication bypass is two-fold: 1. Subdomain saostatic.uber.com was...

Internet Bug Bounty: OCSP Status Request extension unbounded memory growth (CVE-2016-6304)

A malicious client can send an excessively large OCSP Status Request extension. If that client continually requests renegotiation, sending a large OCSP Status Request extension each time, then there will be unbounded memory growth on the server. This will eventually lead to a Denial Of Service...

ok.ru: http://217.20.144.201 privilege escalation in apache tomcat SessionEample-script

Tomcat Servlet Examples application was accessible at wmf.ok.ru which leaved ok.ru vulnerable to cookie manipulation http://lab.onsec.ru/2013/03/tomcat-servlet-examples-threats.html and whatever else vulnerability Servlet Examples might contain...

Internet Bug Bounty: mod_proxy_fcgi buffer overflow

This issue was reported directly to the Apache team. A buffer overflow was found in modproxyfcgi. A malicious FastCGI server could send a carefully crafted response which could lead to a heap buffer overflow. http://httpd.apache.org/security/vulnerabilities24.html2.4.11-dev...

Internet Bug Bounty: Same Origin Security Bypass Vulnerability

This bug was reported directly to Adobe. http://helpx.adobe.com/security/products/flash-player/apsb14-08.html...

Nextcloud: Weak ssh algorithms and CVE-2023-48795 Discovered on various subdomains of nextcloud.com

Security researchers discovered a vulnerability in the Secure Shell SSH cryptographic network protocol, known as Terrapin CVE-2023-48795. This vulnerability could have allowed an attacker to downgrade the security of the secure channel. Weak SSH algorithms were also identified on various subdomai...

TikTok: Lynxview JS interfaces Takeover via deeplink traversal

The application had vulnerabilities that could have allowed the takeover of JavaScript interfaces via the application's exposed Webview. The issues were only present in older versions of the Android application and were addressed after the researcher reported them to the team...

Internet Bug Bounty: curl cookie mixed case PSL bypass

A vulnerability in curl allowed a malicious HTTP server to set "super cookies" that bypassed the Public Suffix List check, enabling cookies to be sent to unrelated sites and domains...

Internet Bug Bounty: CVE-2023-42663: Apache Airflow: Bypass permission verification to view task instances of other dags

In Apache Airflow versions before 2.7.2, a vulnerability existed that allowed authorized users with access to read specific DAGs to view task instance information from other DAGs by bypassing permission verification. Upgrading to Apache Airflow version 2.7.2 or newer addressed this issue...

curl: CVE-2023-38546: cookie injection with none file

Vulnerability description not provided...

U.S. Dept Of Defense: Adobe ColdFusion - Access Control Bypass [CVE-2023-38205] at ██████

An access control bypass vulnerability was discovered in Adobe ColdFusion, allowing attackers to bypass the restriction on external access to the ColdFusion Administrator...

8x8: Credential leak on GitHub: https://github.com/█/█/ (Peoplesoft CRM)

Credentials for a database associated with Peoplesoft CRM were leaked on GitHub. The leak was reported and the repository containing the credentials was taken down. The credentials were associated with a database that is no longer in use...

U.S. Dept Of Defense: Sensitive Data Exposure via wp-config.php file

Sensitive data exposure occurred via the wp-config.php file, which contained confidential information such as MySQL and AWS credentials and various keys. The vulnerability was found on a specific endpoint, and it could potentially provide unauthorized access to sensitive information to users who ...

Automattic: Stored XSS on app.crowdsignal.com your-subdomain.crowdsignal.net via Thank You Header

A stored XSS vulnerability was found on app.crowdsignal.com, allowing an attacker to execute arbitrary JavaScript code on the victim's browser. The vulnerability could be triggered by editing the Thank You Header with a malicious payload and could result in the compromise of sensitive user...

curl: CVE-2022-32221: POST following PUT confusion

Summary: The bug I submitted at https://github.com/curl/curl/issues/9507 can have at least a few unintended security issues: - Information Disclosure: this bug causes an HTTP PUT to occur when the user intends for an HTTP POST to occur. The user, who intended an HTTP POST, expects the POSTed...

Phabricator: Possible to make restricted files public on Phabricator via Diffusion

Files on Phabricator are always viewable to a user if they are attached to an object that they can view. It seems Phabricator does check if you can view a file before allowing you to a attach it. If you don't have access to the file, it will just look like this F99999999999 in plaintext. It seems...

Paragon Initiative Enterprises: Recaptcha Secret key Leaked

Greeting from @kashifinfo90, I hope Paragonie Security Team is doing great, Following Secret Keys are leaked: "secret-key": "6Ldy5BYTAAAAAPBh868BMm2nGZelOUyXJHTUE4no", "site-key": "6Ldy5BYTAAAAACk3Tj8wDUBLcVxSL2JXFBw-Dtj3" "secret-key": "6Ld27iETAAAAAF6tsd5SaoCgc5cFX-tkfHqx7FtX", "site-key":...

Judge.me : Stored XSS in Email Templates via link

Summary: Stored cross-site scripting also known as second-order or persistent XSS arises when an application receives data from an untrusted source and includes that data within its later HTTP responses in an unsafe way. FYI: I Install judge.me in Shopify E-Commerce Steps To Reproduce: 1. Go to...

Elastic: Fix for CVE-2021-22151 (Kibana path traversal issue) can be bypassed on Windows

Summary Hello team, I hope you're doing well! I was combing through your GitHub repository to look at the fixes for recent security releases and found the fix for CVE-2021-22151 to be incomplete. The current fix makes assumptions that are true on Linux but that don't hold on Windows. Details The...

Basecamp: Login session not expire

@blackbibin reported that after signing in, you could go back in the browser and the login info would still be populated. We've ensured the login page is reloaded in this case...

GitHub Security Lab: [Java] CWE-918: Added URLClassLoader and WebClient SSRF sinks

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: [Java] CWE-326: Query to detect weak encryption with an insufficient key size

This bug was reported directly to GitHub Security Lab...

Concrete CMS: Phar Deserialization Vulnerability via Logging Settings

Vulnerability Description: The vulnerable code is located within the concrete/controllers/singlepage/dashboard/system/environment/logging.php script. Specifically, into the Logging::updatelogging method: public function updatelogging $config = $this-app-make'config'; $request = $this-request; if...

GitHub Security Lab: Java: Detect remote source from Android intent extra

This bug was reported directly to GitHub Security Lab...

HackerOne: Getting New Invitations without Leaving Programs

Hello there, I hope all is well! Description When you leave the private program, you get a chance to get a new invitation. But using this vulnerability, I can get new invitations without leaving private programs. Steps: 1. Go to any private bug bounty program. 2. Click Leave Program button 3. Cli...

BugPoC: LFI to steal /etc/passwd - Bypass filter in the <meta property="og:image"> tag via redirect and much more

Hey Team, Good &simple challenge. Wasn't able to find time to attempt this initially but was able to go about it today. The explanation of the bug with the POC is hosted on bugpoc.com Here is the id & password as requested - BugPoC ID : bp-wHwB2qAF - Password : dARKlYbAnana89 POC Screenshot using...

Open-Xchange: Panic: Input stream data unexpectedly has references

Run test suite binary on following input ./testsuite crash.txt with crash.txt file being : require "vnd.dovecot.testsuite"; require "variables"; require "editheader"; set "message" text: From: [email protected] To: [email protected] Subject: Frop! Frop! . ; testset "message" "$message"; test...

Zomato: Stealing Zomato X-Access-Token: in Bulk using HTTP Request Smuggling on api.zomato.com

Intro Hi Zomato Security Team! My name is Evan Custodio and this is my first time evaluating your platform. I specialize in looking for server-side vulnerabilities. Recently I've taken a deep look at HTTP Request Smuggling issues. I have custom tools to evaluate over 150 types of HTTP Smuggling...

MyEtherWallet: Malicious Node JavaScript Injection Leading to Theft of Private Keys and User Funds

Summary This vulnerability allows injection of arbitrary JavaScript code by the node that the MyEtherWallet user is connected to. This could be one of the default nodes e.g api.myetherwallet.com, or a custom node. With this code injection, the private key can be stolen if Keystore File or Private...

Nextcloud: Code injection in macOS Desktop Client

Vulnerability description I've identified a code injection vulnerability in your macOS desktop client. Any malicious application, running with standard user permissions is able to exploit this vulnerability and execute code in your application's context. Requirements In order to exploit this...

Internet Bug Bounty: buffer overread in base64 code of the xmlrpc module

Malformed input to the xmlrpcdecode function can cause an out of bounds read in the base64 code. This is fixed in the latest updates of PHP 7.3.1 etc. Report: https://bugs.php.net/bug.php?id=77380 Impact If the attacker has access to the decoded output this may leak memory contents...

Node.js third-party modules: Prototype pollution attack in node.extend

I would like to report a prototype pollution vulnerability in node.extend. It allows an attacker to inject properties on Object.prototype. Module module name: node.extend version: 2.0.0 npm page: https://www.npmjs.com/package/node.extend Module Description A port of jQuery.extend that actually...

DuckDuckGo: SSRF on duckduckgo.com/iu/

Normally, a call to https://duckduckgo.com/iu contains a query parameter u with some path using the domain yimg.com. This call will succeed in most cases. F337121 And if we change that path to something like https://google.com it's rejected. F337118 However, it appears that the check that ensures...

Nextcloud: Access control issue -- [Allow file system access not validated when using session auth]

Obtain an App Token 2. Check that you can access the files with this token and save the cookies 3. Revoke filesystem access for this token 4. See that you can still access the files when using the cookies At step 4 there access to the files should also be forbidden...

X (Formerly Twitter): Stealing User emails by clickjacking cards.twitter.com/xxx/xxx

Hello In twitter you can create cards to generate leads. For example: https://twitter.com/i/cards/tfw/v1/759046372544741376?cardname=promotion&autoplaydisabled=true&earned=true&lang=en&cardheight=357 If you visit the above URL and click the button your email and username is sent to my domain. Sin...

X (Formerly Twitter): csp bypass + xss

Hi, On my previous report number 126464 I've mentioned that analytics.twitter.com has a CSP bypass which I couldn't exploit that time. Now, I've found a reflected XSS on careers.twitter.com which again I couldn't exploit by itself. Because you have CSP, and I've combined two of them to successful...

Zendesk: Chat History CSV Export Excel Injection Vulnerability

I have found a vulnerability in the Chat History export function. If an attacker submits a special name containing a system command when chatting with an agent and that agent later exports the history of that chat to CSV, the resulting CSV may execute commands when opened. I have tested this usin...

Internet Bug Bounty: Null pointer dereference in phar_get_fp_offset()

https://bugs.php.net/bug.php?id=69720...

Ruby on Rails: RCE due to Web Console IP Whitelist bypass in Rails 4.0 and 4.1

With the release of Ruby on Rails 4.2 the so called Web Console was introduced. As the Web Console documentation states: Web Console is built explicitly for Rails 4. By default the Web Console is available in the Rails Development Environment and allows only the IPs 127.0.0.1 and ::1 to access th...