h1-ctf: HackyHolidays 2020 Full Write-up: Information Disclosure of 12 Flags

Intro This is my report for the 2020 Hacky Holidays HackerOne CTF. I managed to find all 12 flags with the assistance of my little helper, Jake. He specialises in brute-forcing via a unique keyboard mashing technique: F1134543 Anywho, let's get started... Flag 1: Robots The first one was a nice...

Mail.ru: file read on MCS servers via supplying a QCOW2 image with external backing file

Local file read in mcs.mail.ru by providing QCOW2 disk image with backing image pointing to external file Mail.ru Cloud Solutions allows uploading custom images for disks. This functionality supported QCOW2 disk images. A QCOW2 disk image can have a so-called "backing image" - a file to read...

U.S. Dept Of Defense: https://████ is vulnerable to cve-2020-3452

Description: A vulnerability in the web services interface of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and read sensitive files on a targeted system. The...

Mail.ru: Возможность создать канал в группе, в которой пользователь не является админом [my.games]

Privilege escalation in chat management functionality on store.my.games...

MTN Group: [play.mtn.co.za] Application level DoS via xmlrpc.php

Description Wordpress that have xmlrpc.php enabled for pingbacks, trackbacks, etc. can be made as a part of a huge botnet causing a major DOS/SSRF. The website play.mtn.co.za has the xmlrpc.php file enabled and could thus be potentially used for such an attack against other victim hosts. hackeron...

InnoGames: Stored XSS on recruit.innogames.de

Summary: When applying for a Supporter/Moderator job at recruit.innogames.de the drop-down field "Position" is vulnerable to a stored XSS as the content is not validated. Description: Steps To Reproduce: 1. Visit https://recruit.innogames.de/staemme/de/index/page/show/apply 2. Fill out all requir...

Bitwarden: Server-Side Request Forgery in "icons.bitwarden.net"

As, I already checked with support team via portal, due to domain confirmation I checked with them. Here, adding the required information: Title: Server-Side Request Forgery in "icons.bitwarden.net". URL: https://icons.bitwarden.net/spoofed.burpcollaborator.net/icon.png Parameter: REST based in...

h1-ctf: [H1-2006 2020] Solution for the h1-2006 CTF challenge

Hi, The flag is ^FLAG^736c635d8842751b8aafa556154eb9f3$FLAG$. I didn't know I can send it prior to the report until I saw some disclosed solutions from the previous challenges. The report will follow later today. Regards @thehackerish Impact Multiple vulnerabilities on .bountypay.h1ctf.com allow ...

Topcoder: Reflected XSS on error page on https://apps.topcoder.com/wiki/plugins/socialbookmarking/updatebookmark.action

Hi : In https://apps.topcoder.com/wiki/plugins/socialbookmarking/updatebookmark.action bookmarkPageId parameter expects a number value. If you add XSS payload instead of number, an error page displays with XSS. PoC...

Stripo Inc: [www.stripo.email] You can override the speed limit by adding the X-Forwarded-For header.

Summary In https://stripo.email/template-order I think you have implemented rate limiting via 429 status code for too many requests, but in reality it is not. An attacker could bypass the 429 speed limit by adding an X-Forwarded-For header. Steps To Reproduce 1. Go to the...

U.S. Dept Of Defense: CSRF Account Deletion on ███ Website

Summary: A CSRF vulnerability against the ███████ allows attackers to delete user accounts. Impact Users who visit a malicious website could find their ████████ account deleted. Step-by-step Reproduction Instructions 1. Create and login to a new account on the ██████ 2. Open the provided HTML fil...

Kubernetes: Clickjacking

Report Submission Form Summary: Clickjacking is an attack that tricks a user into clicking a webpage element which is invisible or disguised as another element Description: Clickjacking User Interface redress attack, UI redress attack, UI redressing is a malicious technique of tricking a Web user...

PlayStation: Authorization Token on PlayStation Network Leaks via postMessage function

Description After some analysis on how playstation network authentication work, I came across a certain pattern of how authorization tokens are handled. The web application utilizes postMessage function to exchange authorization tokens between windows/frames. To simplify this, let's follow on one...

Kartpay: Referer issue in Kartpay.com

on https://Kartpay.com. The Issue of Referer was Fixed earlier before reporting this issue again but on finding the root cause it was found that the Code is perfect but the Sequence of code / Priority of code has changed which leads to Referer issue again. So The Sequence of Code has changed to...

MyEtherWallet: Local Storage Custom Node Credentials Leak

Summary Credentials for a custom node are stored in plain text inside Local Storage on the user's machine. If this node is configured in a certain way this could lead to the theft of any funds in accounts attached to this node, by a local attacker. And if not configured this way, an attacker coul...

ZEIT: Open redirect vuln on login

Summary: An attacker can redirect vicitm on an external website using https://zeit.co/login endpoint because next parameter Steps To Reproduce: add details for how we can reproduce the issue 1 .Go To https://zeit.co and login there 2 .after login go to...

Unikrn: Full Path Disclosure

HI security team! we can see path on your resource. https://crm.unikrn.com/app/bundles/CampaignBundle/EventListener/LeadSubscriber.php You must create a ban on viewing the script from the outside using .htaccess Impact Full Path Disclosure https://www.owasp.org/index.php/FullPathDisclosure...

Passit: password rest link not expired after change the password

Hi, this is my first report and bug .. i found password rest link not expired after change the password by resiver my e-mail Proof of Concept: 1Go to https://app.passit.io/account/reset-password and ask for password reset link. 2go to Email inbox. 3clicke to link from inbox example // Recovery li...

X (Formerly Twitter): IDOR and statistics leakage in Orders

Description: Twitter on its service "MoPub" statistics dedicated to the results of "Order", after the test shows that the endpoint "https://app.mopub.com/web-client/api/orders/stats/query" is infected with a "IDOR " bug Which led to the leak of private statistics "Orders" by another users Steps T...

Zomato: credentials leakage in public lead to view dev websites

Description: Hello Zomato team : So after I found a new OSINT website ████ which fetch results from Pastebin website, I searched for "zdev.net" and I got this interesting result ██████████ F443315 I logged in https://gazal.zdev.net/test.php after I decoded Base64 Authorisation ███ F443316 I tried...

Shopify: Bypass GraphQL rate limit by abusing negative cost queries

Hi security team, While looking into the graphql app I noticed an interesting implementation where each app has a bucket of query cost they are allowed to used in a given time with a certain refresh rate associated with it. The details can be found at...

Internet Bug Bounty: Heap Buffer Overflow (READ: 4) in phar_parse_pharfile

Phar files with HALTCOMPILER; in unexpected places can lead to a buffer overrun. This is something I found while fuzzing with AFL using an ASAN instrumented PHP. The issue can be observed by disabling the ZEND allocator and using ASAN or valgrind/etc? with a crafted phar as input. I have prepared...

HackerOne: Accidental Access to Programs Information via SAML Login

On November 8th, 2018, HackerOne released software to production that contained a bug which impacted our Security Assertion Markup Language SAML authentication system. As a result of the bug, the SAML JIT Just-In-Time provisioning mechanism granted users of one customer program read-only access t...

PayPal: XSS [flow] - on www.paypal.com/paypalme/my/landing (requires user interaction)

Steps to reproduce On Chrome and Firefox: 1. Go to...

New Relic: WordPress username enumeration (/author)

@rootbakar identified a previously-reported issue where authors could be viewed from an endpoint within our WordPress blog. As authors are intended to be public, this was closed as not having any security impact to the blog...

HackerOne: User login page doesn't implement any form of rate limiting

Hi Team, Summary: As a best practice a login page should have a rate limitting just like hackerone.com Vulnerable Request POST /auth/postlogin HTTP/1.1 Host: ctf.hacker101.com User-Agent: Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: https://ctf.hacker101.com/...

Upserve : OLO Total price manipulation using negative quantities

Manipulating an order request JSON object, containing an additional item with a negative quantity directly manipulates the total amount of the order. In the following JSON request, an order is submitted for 2 ChickenBurgers $12 each, as well as -1 BreadPuddings $9 each. The total price after tax...

Nextcloud: File access control rules not enforced on image files

Installed Nextcloud from Snap package version 13.0.2snap1, revision 6916 on fresh Ubuntu 18.04 LTS install. 2. Installed and enabled Files access control v1.3.0 and Files automated tagging v1.3.0 apps. 3. As an administrator created an invisible collaborative tag Secret. 4. Added Files automated...

Trello: Trello Gold accounts free for 1 year

It is possible to create Trello Gold accounts and use it for free for 1 year. The issue lies in credit card validation. PoC: 1. Create a new trello account 2. After verification, go to Profile Trello Gold 3. Choose billed annually, enter a valid credit card number with $0 on it. and click on...

Semrush: subdomain takeover at news-static.semrush.com

Summary: The subdomain news-static.semrush.com can be taken over by attackers and abuse it for further attacks Phishing, XSS Cross origin, malware, etc... Description: The subdomain news-static.semrush.com was pointed using CNAME to Amazon S3, but no bucket with that name was registered. This mea...

Internet Bug Bounty: Heap Use After Free Read in unserialize()

ext/standard/varunserializer.re in PHP 7.0.x through 7.0.22 and 7.1.x through 7.1.8 is prone to a heap use after free while unserializing untrusted data, related to improper use of the hash API for key deletion in a situation with an invalid array size. Exploitation of this issue can have an...

Zomato: SQL Injection, exploitable in boolean mode

Issue The reporter found a SQL injection in one of the applications in www.zomato.com. Fix The issue was investigated and found to be valid and fixed...

HackerOne: Lack of input sanitization in Marketo form leads to execution of HTML in lead emails

Hi, There is SSRF vulnerability due to img tag injection in "Contact HackerOne Sales" form. Since vulnerability triggers after 18-20 minutes so I am not sure which site it affects. It might affect hackerone or marketo. So I thought it would be better to report it first on hackerone. POC 1. Naviga...

Automattic: Captcha bypass for the most important function - At en.instagram-brand.com

Product / URL https://en.instagram-brand.com/wp-json/brc/v1/approval-requests Description and Impact The Instagram Brand Site has a functionality for business users to request for using Instagram Assets. The URL for creating a new request is: https://en.instagram-brand.com/requests/new There is a...

Internet Bug Bounty: libtiff 4.0.6 heap bufer overflow / out of bounds read (CVE-2016-9273)

heap buffer overflow affecting libtiff 4.0.6 and possibly earlier. This library is baked into web browsers used by millions and also devices like the PlayStation Portable and the iPhone. http://bugzilla.maptools.org/showbug.cgi?id=2587 Reported to vendor on 7 November 2016: ==18669==ERROR:...

Nextcloud: \OCA\DAV\CardDAV\ImageExportPlugin allows serving arbitrary data with user-defined or empty mimetype

The SabreDAV plugin \OCA\DAV\CardDAV\ImageExportPlugin is used for displaying pictures of a VCF. It registers on a GET request on a CardDAV element and acts when the query parameter photo is sent. The logic can be seen below: / Intercepts GET requests on addressbook urls ending with ?photo. @para...

Internet Bug Bounty: Memory Leakage In exif_process_IFD_in_TIFF (CVE-2016-7128)

I found some vulnerable code that leads to the memory leak in exifprocessIFDinTIFF. Let take look at code chunk : if !ImageInfo-Thumbnail.data && ImageInfo-Thumbnail.offset && ImageInfo-Thumbnail.size && ImageInfo-readthumbnail ImageInfo-Thumbnail.data = safeemallocImageInfo-Thumbnail.size, 1, 0;...

HackerOne: Web Authentication Endpoint Credentials Brute-Force Vulnerability

Dear, Your web authentication endpoint, https://hackerone.com/sessions POST, currently protects against credentials brute-force attacks only by requests rate-limiting based on IP. It was found that if an attacker sends login requests faster than every 4 seconds from the same IP address, it would...

VK.com: Внедрение внешних сущностей в функционале импорта пользователей YouTrack

Уязвимость существует из-за возможности использования внешних сущностей XML разметки в функционале импорта пользователей YouTrack. Веб-приложение доступно по адресу youtrack.vk-cdn.net Исходя из документации https://confluence.jetbrains.com/display/YTD6/Import+Users поддерживает импорт данных...

VK.com: Уязвимость в Указание мест на фото + фича + хакинг

Для начало прошу прощения за столько много выделенных ТИПОВ ... коротко с помощью уязвимости можно ставить отметку на фото гео лакации любому пользователю Следование этому пожеланию увеличит вероятность получения награды. Сервис, в котором найдена уязвимость. https:/vk.com/alplaces.php...

Internet Bug Bounty: Buffer Over-read in unserialize when parsing Phar

https://bugs.php.net/bug.php?id=69324 ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to obtain sensitive information from process memory or cause a denial of service buffer over-read and application crash via a crafted length value in...

HackerOne: Window Opener Property Bug

The bug mentioned in 23386 is not yet correctly patched I believe. See, if a user sets his/her profile's website link to a similar page as mentioned in 23386. I mean a page that can manipulate the window.opener property would be able to accomplish similar results as in 23386 Proof-of-Concept: 1...

Mail.ru: rs.mail.ru - Flash Based XSS

Hi, I found a flash based XSS in rs.mail.ru. Vulnerable link: http://rs.mail.ru/b27161485.swf?link1=javascript:alertdocument.domain Just click on the page and you will see the alert. Tested on Mozilla Firefox Regards, Florin...

Slack: Email enumeration

Navigate to the page - https://slack.com/signin Now, entering invalid email address returns an erroneous response. However, if you enter a valid email address like [email protected], it redirects you to a different page where it asks you to choose teams that belongs to [email protected]. You can then...

RelateIQ: Value of JSESSIONID and XSRF token parameter in cookie remains same before and after login

Here are two same values captured via intercepting the request and the value of JSESSIONID and XSRF remains same before and after login JSESSIONID=m8u0pm8mjvckm1ya8da4oqlfb0pd34iw38lr; XSRF-TOKEN=6B025F41D13BC02E9D658409BAC23F84; This could lead to further threats such as session hijacking etc...

Yahoo!: SQLi on http://sports.yahoo.com/nfl/draft

Thank you for your submission to the Yahoo Bug Bounty program. We were able to reproduce the issue you reported and have implemented appropriate fixes. We appreciate your adherence to responsible disclosure guidelines and look forward to your future participation in the program...

Node.js: Improper Input Validation — HTTP Response Parser Unconditionally Accepts Bare CR in Status Line

The llhttp HTTP response parser in Node.js up to version 24.14.1 llhttp v9.3.0 and v9.3.1 was found to unconditionally accept a bare carriage return CR as a valid response status line terminator. This parsing asymmetry was present in the response path but not in the request parsing, enabling...

Internet Bug Bounty: important: Apache HTTP Server: Crash resulting in Denial of Service in mod_proxy via a malicious request (CVE-2024-38477)

important: Apache HTTP Server: Crash resulting in Denial of Service in modproxy via a malicious request CVE-2024-38477 A null pointer dereference vulnerability was discovered in modproxy in Apache HTTP Server versions 2.4.59 and earlier. This vulnerability allowed an attacker to crash the server ...

Internet Bug Bounty: CVE-2024-31079 in nginx

CVE-2024-31079 was discovered in the NGINX HTTP/3 QUIC module. When NGINX Plus or NGINX OSS were configured to use this module, undisclosed HTTP/3 requests could cause NGINX worker processes to terminate or experience other potential impact. The vulnerability was classified as a stack-based buffe...

Internet Bug Bounty: http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks

A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and denial of service DoS. The server reads an unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk...