h1-ctf: [h1-415 2020] Solution for h1415's CTF challenge

Summary: I have just solved the challenge, write-up will follow shortly. Impact Flag: h1ctfy3s1mc0sm1cn0w...

h1-ctf: [h1-415 2020] My writeup on how to retrieve the special secret document

Summary: An attacker without any privilege is able to retrieve the special secret document, hosted on the https://h1-415.h1ctf.com website. To do so, multiple steps are required : 1. The authentication must be bypassed to have a licensed account; 2. The support team portal is vulnerable to a blin...

h1-ctf: [H1-415 2020] CTF Writeup

As there is a bonus for the first solver, I am sending only the flag for now. F687111 Impact...

Kubernetes: Username enumeration via Openssh 7.6

Username enumeration I have found a vulnerability in your site that allows me to verify if an user exits in the ssh due to the use of OpenSSH 7.6p1. PoC 1 Download and compile the given exploit file 2 open a terminal and run the exploit I have attached a Screenshot if detailed PoC is needed pleas...

New Relic: Restricted user can update Apdex target for applications by leveraging the GraphQL mutation

Hey team, I've found that Restricted user can update Apdex target for applications by leveraging the GraphQL mutation which doesn't properly implement authorization. Steps to reproduce 1 Sign in NR with Restricted user 2 Navigate to https://api.newrelic.com/graphiql, intercept the request to...

Node.js third-party modules: [chart.js] Prototype pollution

I would like to report a prototype pollution vulnerability in chart.js It allows an attacker to inject properties on Object.prototype which can for some applications lead to XSS. Module module name: chart.js version: 2.9.3 npm page: https://www.npmjs.com/package/chart.js Module Description Simple...

Razer: Access to support tickets and payment history, impersonate razer support staff

The tester discovered the mysupport.razer.com site was vulnerable to a authentication bypass that allowed access to support tickets. Razer thanks the tester for the detailed PoC and diligence in helping us secure our customer's information...

Kubernetes: Half-Blind SSRF found in kube/cloud-controller-manager can be upgraded to complete SSRF (fully crafted HTTP requests) in vendor managed k8s service.

Hello, Who we are : We’re two French security researchers and our respective names are Brice Augras and Christophe Hauquiert, we worked and found the vulnerability together. Brice Augras from https://www.groupe-asten.fr/ company - https://hackerone.com/reeverzax Christophe Hauquiert -...

Revive Adserver: Reflected XSS on www/delivery/afr.php

At line 4381, $SERVER'QUERYSTRING', which is an untrusted user input, is assigned to the $dest variable. Then at lines 4386-4387 $dest is printed into HTML code in two separate places. PoC: curl "domain.com/www/delivery/afr.php?refresh=10000&"',10000000;alert1;setTimeout'alert"" Advertisement --...

DRIVE.NET, Inc.: Testing for arbitrary HTTP methods

Test for allowed HTTP methods on the server. Below are the steps to reproduce it. Step 1. Navigate the url Step 2. Intercept the GET http request using burp suite Step 3. change GET to ABCD as shown in screenshot and forward this request to server Step 4. Observe the http response from the server...

Kubernetes: No valid SPF record found

Desciprition : There is a email spoofing vulnerability.Email spoofing is the forgery of an email header so that the message appears to have originated from someone or somewhere other than the actual source. Email spoofing is a tactic used in phishing and spam campaigns because people are more...

MariaDB: Exposed debug.log file leads to information disclosure

At the following address i have found debug.log file disclose the application full path on the server. And there is database username too in debug.log http://mariadb.org/wp-content/debug.log Impact Information disclosure...

Kubernetes: Sensitive Information disclosure Through Config File

Report Submission Form Summary: hello Team while Exploring Your Site.I found Config File Is leaked In Your Site Where Contains Sensitive Information,Credentials ETc Vulnerable URL:- https://prow.k8s.io/config Impact Attacker Is Able To Gain sensitive Information About target and Also might Get...

Kubernetes: Kubelet resource exhaustion attack via metric label cardinality explosion from unauthenticated requests

Report Submission Form Summary: Malicious clients can potentially DOS a kubelet by sending a high amount of specially crafted requests to the kubelet's HTTP server. For each request the kubelet updates/sets 3 metrics: - kubelethttprequeststotal Counter - kubelethttprequestsdurationseconds Histogr...

curl: Division by zero if terminal width is 2

Summary: In fly there will be a division by zero if progress bar width is 2. That can happen if terminal width is 2. Steps To Reproduce: This script crash: stty rows 10 cols 2 ; curl --progress-bar somefile temp Impact I believe that if it's possible to set terminal width for a service, then that...

Kubernetes: Configuartion [Sensitive] Information Disclosure

Report Submission Form Hello Team, The Configuration Details are being leaked by the following url: https://prow.k8s.io/config Steps to Reproduce Click on the Below link to reproduce the issue - https://prow.k8s.io/config Impact The Sensitive Information is being leaked. This information can be...

U.S. Dept Of Defense: Reflected cross-site scripting vulnerability on a DoD website

Hello there ! I'd like to report a 'XSS' vulnerability on a DoD website https://███/unit/███ , Here in the search engine of the website please enter the following payloads alertdocument.domain & you can even use this payload to steal cookies alertdocument.cookie and hit enter and just scroll you'...

Ubiquiti Inc.: Web Server Predictable Session ID on EdgeSwitch

In EdgeSwitch legacy web interface the SIDSSL cookie for admin can be guessed, enabling the attacker to obtain high privileges and get a root shell by a Command injection. These vulnerabilities were found on EdgeSwitch 1G switch ESWH and EdgeSwitch 10G switch ESGH firmware v1.9.0. The fix for the...

Yelp: No rate limiting for confirmation email lead to email flooding

Description: There is no rate limiting implemented in sending the confirmation email. Thus, attacker can use this vulnerability to bomb out the email inbox of the victim. Affected URL: https://biz.yelp.com/welcome/resendconfirmation with POST method Details: 1. Login to biz.yelp.com 2. Go to...

8x8: xmlrpc.php file enabled

Wordpress instance with xmlrpc module enabled...

Dropbox: Local Privilege Escalation on Dropbox Desktop for Windows

This report describes a local privilege escalation in the Dropbox automatic updater process on Windows. It would allow a malicious actor who had already gained non-admin access to a Windows computer to obtain admin privileges, if Dropbox had previously been installed with admin privileges. This...

Mail.ru: Account TakeOver at my.33slona.ru

Logon via SMS code validation was not sufficiently protected against bruteforce in my.33slona.ru Common flaws of SMS auth: https://blog.deteact.com/common-flaws-of-sms-auth/...

curl: Port and service scanning on localhost due to improper URL validation.

Summary: Generally web masters and developers protect user-accessible CURL from requesting forbidden domains so that the attacker is not able to access internal resources. It is usually done using regular expressions. Mostly addresses like 127.x.x.x, 192.168.x.x and "integer" notation of IP...

Razer: Aws bucket writable mobile.razer.com

The tester discovered an S3 bucked owned by Mobile that was writeable. No files were present but the permissions were incorrect and subsequently fixed. Razer appreciates the report...

Nord Security: Password Reset Link Works Multiple Times

Background: Normally, a secure way to handle password reset links is to invalidate the link/token upon usage. Additionally, if multiple reset links are requested, older & unused tokens should also be invalidated i.e., if 2 reset tokens were requested, the 2nd token should be invalid upon your usa...

8x8: Disclosure of Users Information On Wordpress Api [https://jitsi.org/]

Jitsi was running a default WordPress site that had not yet been hardened to prevent user enumeration via the API...

MTN Group: Unsafe cors sharing of admin users

hello, the following endpoint https://lonestarcell.com/wp-json/wp/v2/users/ has an unsafe sharing of sensitive information of admin usernames check poc script below : html CORS PoC Exploit function cors var xhr = new XMLHttpRequest; xhr.onreadystatechange = function if this.readyState == 4 &&...

Node.js third-party modules: [node-downloader-helper] Path traversal via Content-Disposition header

Summary I would like to report path traversal in node-downloader-helper. It allows malicious server to choose download location via ../. It may leads remote code execution. Module module name: node-downloader-helper version: 1.0.11 npm page: https://www.npmjs.com/package/node-downloader-helper...

Node.js third-party modules: [blamer] RCE via insecure command formatting

I would like to report a RCE issue in the blamer module. It allows to execute arbitrary commands remotely inside the victim's PC Module module name: blamer version: 0.1.13 npm page: https://www.npmjs.com/package/blamer Module Description Blamer is a tool for get information about author of code...

Mail.ru: [c-api.city-mobil.ru] Client authentication bypass leads to information disclosure

API endpoint at c-api.city-mobil.ru allowed access to subset of order and client related information without proper authorization Broken authentication in the client API allowed retrieving sensitive information about clients: finished trips w/o departure and destination points, payments type,...

Razer: Reflected XSS at http://promotion.molthailand.com/index.php via promotion_id parameter

The tester discovered a reflected XSS vulnerability on https://easytopup.in.th related to a URL parameter. This issue affected the Firefox browser. Razer thanks the tester for the report and the clear proof of concept...

DRIVE.NET, Inc.: Same site Scripting

Same site scripting I have found an error of some misconfigured DNS in a subdomain of yours which causes same site scripting. PoC 1 Open a terminal and type ping localhost.drive2.ru You would see that it resolves back to 127.0.0.1 A screenshot has been attached Impact This may cause security issu...

Nord Security: nordvpn Linux Desktop executable application does not use pie / no ASLR

Summary: The nordvpn Linux binary application is not compiled as position independent code or position independent Executable. Steps To Reproduce: POC: $file /usr/bin/nordvpn /usr/bin/nordvpn: ELF 64-bit LSB executable, x86-64, version 1 SYSV, dynamically linked, interpreter...

DRIVE.NET, Inc.: Хранимый XSS в Business-аккаунте, на странице компании

Приложение уязвимо к атакам Типа "Межсайтовое выполнение сценариев". Тип XSS - Хранимый Persistent. Для воспроизведения атаки нужно зарегистрироваться на сайте drive2.ru и подключить бизнес-аккаунт. После чего переходим в панель управления компанией и заполняем все необходимые поля для успешной...

Clario: Open redirect on https://account.mackeeper.com

Summary An attacker can redirect a user to any external website using the vulnerable parameter in https://account.mackeeper.com/auth/fb use parameter continue. Steps To Reproduce 1. Visit the following url: https://account.mackeeper.com/auth/fb?continue=https://google.com 2. Login 3. This will...

Semrush: An attacker can buy marketplace articles for lower prices as it allows for negative quantity values leading to business loss

Hi there, When we Summary: When someone goes to https://www.semrush.com/marketplace/offers/ and orders for articles, an attacker can pay for less than intended due to negative quantities being allowed. Steps To Reproduce: - Go to https://www.semrush.com/marketplace/offers/ - Click on 500 Words$40...

Zomato: Stealing Zomato X-Access-Token: in Bulk using HTTP Request Smuggling on api.zomato.com

Intro Hi Zomato Security Team! My name is Evan Custodio and this is my first time evaluating your platform. I specialize in looking for server-side vulnerabilities. Recently I've taken a deep look at HTTP Request Smuggling issues. I have custom tools to evaluate over 150 types of HTTP Smuggling...

Node.js: CRLF Injection in legacy url API (url.parse().hostname)

Summary: There is CRLF Injection in legacy url.hostname API. Description: During the recent penetration test, I have found a whitelist bypass using CRLF Injection. We did a code review and determined the issue is in a legacy url.hostname API. Not sure if it's a known issue or not, I wasn't able t...

Smule: Open redirect bypass & SSRF Security Vulnerability

Open redirect issue. Full disclosure/writeup: https://medium.com/@snwlvl...

Stripo Inc: SSRF & unrestricted file upload on https://my.stripo.email/

The researcher discovered an SSRF & unrestricted file upload Remote code execution vulnerabilities...

U.S. Dept Of Defense: Blind SQL Injection

Bug is : Blind Sql injection SQL injection is a vulnerability that allows an attacker to alter back-end SQL statements by manipulating the user input. An SQL injection occurs when web applications accept user input that is directly placed into a SQL statement and doesn't properly filter out...

8x8 Bounty: Reflected xss on 8x8.vc

A reflected cross-site scripting issue was discovered within the account setup workflow of 8x8.vc...

Ping Identity: No valid SPF record not found

There are no SPF Records found for ort-admin.pingone.com Description: There is an email spoofing vulnerability. Email spoofing is the forgery of an email header so that the message appears to have originated from someone or somewhere other than the actual source. Email spoofing is a tactic used i...

Ping Identity: Forbidden access to https://apps-staging.pingone.com but "/packages.json" visible and full path disclosure

Summary: If you visit the application https://apps-staging.pingone.com/. The application is protected from unauthorized users displays Forbidden. In spite of having this protection, an attacker would be able to see the packages information of the application. Steps To Reproduce: Go to...

Mail.ru: Insecure storage of private files

"Send to myself" activity of Mail.ru Mail application for Android could be locally manipulated via external content provider to access the files in application folder...

8x8: Insecure OAuth redirection at [admin.8x8.vc]

The meetings admin application performed an insufficient validation of the specified redirect location during OAuth negotiation. There was an improper redirection in "admin.8x8.vc" oauth that lead to takeover the admin.8x8.vc SSO accounts , When trying to adding an admin account in admin.8x8.vc...

8x8: Reflected xss on 8x8.com subdomain

The Beta version of a new chat API was discovered to contain a reflected XSS flaw. With the help of the researcher we were able to resolve the issue and ensure the future chat product will not contain this flaw. Write-up for beginners like me.. hackwithcommunity...

Ian Dunn: Dos https://iandunn.name/ via CVE-2018-6389 exploitation

Similar to 752010 Detail:- There is possibility in /wp-admin/load-scripts.php script to generate large 3Mb amount of data via simple non-authenticated request to server. The vulnerability is registered as https://vulners.com/cve/CVE-2018-6389 Detailed attack scenario is described for example here...

X (Formerly Twitter): Bypass Password Authentication for updating email and phone number - Security Vulnerability

Summary: Additional requirement for authentication is an extra layer of security for a person's Twitter account. Instead of only entering the password at the time of log in, twitter further Introduces additional layer of security by prompting users to enter their password before attempting to...

X (Formerly Twitter): Reflected XSS in twitterflightschool.com

While testing twitterflightschool.com, I came across the below endpoint: https://twitterflightschool.com/authentication/fbcallback?error=accessdenied&errorcode=200&errordescription= I noticed that it is possible to inject JS payload in "errordescription=" parameter and trigger XSS in...