Node.js: HTTP header values do not have trailing OWS trimmed

I suspect I may have tagged the wrong vulnerability type -I'm failing to find "insufficient validation of user input" According to the HTTP-spec, http values are field-value = field-content | LWS httpparser does not appear to trim trailing LWS. This means if a user sends "Host: foo\r\n" the strin...

Node.js third-party modules: Filesystem Writes via `yarn install` via symlinks and tar transforms inside a crafted malicious package

I would like to report an arbitrary filesystem write vulnerability in Yarn when installing a malicious package from the default repositories. This vulnerability has the potential for RCE -- even if --ignore-scripts is disabled. It allows a malicious package, upon install, to write to any path on...

Node.js third-party modules: [npm-git-publish] RCE via insecure command formatting

I would like to report a RCE issue in the npm-git-publish module. It allows to execute arbitrary commands remotely inside the victim's PC Module module name: npm-git-publish version: 0.2.4-beta npm page: https://www.npmjs.com/package/npm-git-publish Module Description Share/publish private packag...

Node.js third-party modules: [gity] RCE via insecure command formatting

I would like to report a RCE issue in the gity module. It allows to execute arbitrary commands remotely inside the victim's PC Module module name: gity version: 1.0.5 npm page: https://www.npmjs.com/package/gity Module Description A nice Git wrapper for Node. Module Stats 3/4 downloads in the las...

Mail.ru: Account TakeOver through password recovery at am.ru

Insufficient protection allowed account takeover at am.ru via account recovery code bruteforcing Common flaws of SMS auth: https://blog.deteact.com/common-flaws-of-sms-auth/...

Genasys Technologies: Login Bypass to OTP Enumeration

Summary: If an attacker gets access to the victim's username or know the email used for logging in to the application.He can bypass the login by enumeration og One Time Password. Steps To Reproduce: 1.Go to https://staging.genasystech.co.uk/d2c/ 2.Create an account ,Enter the relevant pin for...

Genasys Technologies: Ability to bypass social OAuth and take over any account [d2c-api]

Summary: An attacker is able to login to any email account that doesn't belong to him through using the OAuth functionality https://staging.genasystech.co.uk/d2c-api/v1/account/login/provider Steps To Reproduce: 1. Register an account with an email and verify it using the one time code that is...

Shopify: Stored XSS in private message

1.Open customer function https://mosuan-img-src-x.myshopify.com/admin/customers 2.Click on the customer's email address F625957 3.Click the sent message on the current page F625959 Impact admin...

GitLab: Double linking cause XSS (but blokeced by CSP in gitlab.com)

Summary URL display on Gitlab.com is currently broken. There is a risk of XSS due to double conversion of URLs into links. However, 12.5 incorporating the fix has not yet been released and is blocked by CSP at gitlab.com. Steps to reproduce 1. Login to gitlab.com 2. Create new project 3. Create a...

VK.com: Отправка подарков/стикерпаков не теряя голоса.

Race-Condition...

Shopify: Shopify's SF and LA offices Dashboard Information disclosed via Public Gist

Hi Team, During my recon process, I found a public gist containing the Internal Information of the Shopify offices of LA and SF. The gist belongs to the Shopify employee - https://gist.github.com/runmad He is currently - Engineering Manager at Shopify LA Office Dashboard -...

GSA Bounty: Cache poisoning DoS to various TTS assets

I have recently come across a technique to force a Cloudfoundry app to return a HTTP 404 error when requesting any resource, which contains cache friendly headers. What this means is, if the Cloudfoundry app in question is behind a web cache like Cloudfront or Cloudflare etc, it will possibly sto...

U.S. Dept Of Defense: [HTAF4-213] [Pre-submission] Unsafe AMF deserialization (CVE-2017-5641) in Apache Flex BlazeDS at the https://www.███████/daip/messagebroker/amf

The vulnerability was an unsafe AMF Action Message Format deserialization issue in Apache Flex BlazeDS, affecting the /daip/messagebroker/amf endpoint. Successful exploitation could allow an attacker to trigger a DNS lookup by sending a crafted AMF payload. The vulnerability was identified and...

Lark Technologies: [CSRF] No Csrf protection against sending invitation to join the team.

A Cross-Site Request Forgery CSRF vulnerability was found on a "Create Invite" endpoint, which could result in any users being added to a team by tricking another user to run this Proof of Concept. We thank @imrannisar for reporting this to our team...

U.S. Dept Of Defense: [HTAF4-213] [Pre-submission] CVE-2018-2879 (padding oracle attack in the Oracle Access Manager) at https://█████████

Description We were able to identify CVE-2018-2879 in Oracle Access Manager, used on the https://██████ Link to the CVE: https://nvd.nist.gov/vuln/detail/CVE-2018-2879 This vulnerability is rated critical, and may allow unauthenticated attacker with network access via HTTP to compromise Oracle...

Node.js third-party modules: [git-promise] RCE via insecure command formatting

I would like to report a RCE issue in the git-promise module. It allows to execute arbitrary commands remotely inside the victim's PC Module module name: git-promise version: 0.3.1 npm page: https://www.npmjs.com/package/git-promise Module Description Simple wrapper that allows you to run any git...

Node.js third-party modules: [meta-git] RCE via insecure command formatting

I would like to report a RCE issue in the meta-git module. It allows to execute arbitrary commands remotely inside the victim's PC Module module name: meta-git version: 1.1.2 npm page: https://www.npmjs.com/package/meta-git Module Description git plugin for meta Module Stats 60 downloads in the...

Rocket.Chat: Clickjacking in the admin page

Summary: Hello Rocket.Chat, There is a clickjacking vulnerability in a very critical page which is the admin info page. For my installation, the URL https://penetrationtester.rocket.chat/admin/users was used for creating the PoC. Description: Clickjacking User Interface redress attack, UI redress...

U.S. Dept Of Defense: [HTAF4-213] [Pre-submission] XSS via arbitrary cookie name at the https://www2.██████/nssi/core/dot_stu_reg/Registration.aspx

The researcher identified a reflected cross-site scripting XSS vulnerability in the cookie name on the https://www2.██████/nssi/core/dotstureg/Registration.aspx endpoint. The first cookie name was reflected on the page without sanitization. A proof of concept was demonstrated by setting a malicio...

Mail.ru: [pandao.ru] possibility to attach arbitrary phone number to account registered via social network

It was possible to attach an arbitrary unregistered phone number to account registered via different id e.g. social network id. This behavior can prevent user from registering with his phone number and facilitate phishing attack if victim attempts to login by phone number...

Yoti: [www.yoti.com] Wordpress user admin information discloure

Summary This website using Wordpress CMS, so developer forget to disable the link that can view information of admin user. By access to this link, attacker can get all username and other information of user admin: https://www.yoti.com/wp-json/wp/v2/users ████ Admin user list: 1. ███████ 1. █████ ...

LY Corporation: Path traversal in filename in LINE Mac client

Initially, @hackerontwowheels and @renekroka discovered that by using a path traversal payload combined with to block out the file extension, arbitrary, pre-installed applications could be executed. It was not possible to provide additional arguments to these applications, however. The payload us...

Snapchat: Bypass Rate Limits on app.snapchat.com API Endpoint via X-Forwarded-For Header

An attacker can bypass the rate limiting in place at app.snapchat.com by setting the X-Forwarded-For header to 127.0.0.1 in POST requests to app.snapchat.com/storieseverywhere/downloadsms and several other endpoints. This bypasses the controls in place for this endpoint, which appears to have...

New Relic: [Bypass] Code injection to open redirect in https://insights.newrelic.com/accounts/2521182/dashboards/1026927

INTRODUCES: Overcoming mechanism of controlling url insertion, redirecting users to fake pages STEPS: Payload: Add dashboard note and insert code malicious. Code : Click link to view note detail : Impact Redirecting users to malicious pages, stealing user information such as fake scripts and user...

Slack: Header modification results in disclosure of Slack infra metadata to unauthorized parties

I found files.slack.com domain will honor the X-Forwarded-Host header, instead of host header. Although file.slack.com has host validation to return 500 Internal server error when host is not files.slack.com, I can bypass the validation by appending @ at the end of host name. Also, the server wil...

GSA Bounty: HTTP Request Smuggling on https://labs.data.gov

Greetings, The application appears to be vulnerable to HTTP request smuggling due to a disagreement between the front-end and back-end server, where the front-end server uses the Transfer-Encoding header to determine content in the HTTP body, but back-end server uses the Content-Length header,...

Mail.ru: HTTP-Response-Splitting leads to information disclosure (email, firstname, lastname) at https://tz.mail.ru

CRLF injection via GET paramaters in tz.mail.ru Clientside vulnerabilities in tz.mail.ru is not currently covered by Bug Bounty program...

Mail.ru: Open Redirect

Hello Team Mail.ru Open Redirect on http://aw.mail.ru/ There is an Open Redirect on http://aw.mail.ru/dynamic/auth/?forumreg= due to the application not checking the value passed by the user to the "forumreg" parameter. User can be redirect to malicious site PoC: Open Redirect...

Node.js third-party modules: Crash Node.js process from handlebars using a small and simple source

I would like to report Denial of service in handlebars. It allows an attacker to crush Node.js process with a small and simple source. Module module name: handlebars version: 4.5.1 npm page: https://www.npmjs.com/package/handlebars Module Description Handlebars.js is an extension to the Mustache...

Moneybird: IDOR in https://moneybird.com/user/accountant_company/edit(change company name)

Reporter found a way to change the name of an accountant company for which he didn't have permissions. We added extra checks to prevent these kind of Insecure Direct Object Reference bugs...

curl: SMB access smuggling via FILE URL on Windows

Summary: While CURL 7.62 parses URLs that have an ? parameter separator char after the fragment separator, CURL urlapi code treats the path with the hash part as it being the same one, this may allow some problem on specific protocols that may have a security impact. On HTTP, an attacker may be...

VK.com: Мини-уязвимость в обработке ссылок

Проблема с парсингом ссылок. В 2013 существовал баг, который позволял при нажатии на лайк к записи перенаправить пользователя по ссылке. Необходимо было закодировать любую ссылку в HTML-мнемонику типа & ; и после публикации разметка у поста сразу ломалась. Тогда эту, со стороны безобидную, дырку...

Mail.ru: unauthorized access to add admin endpoint

Access to static page within media-poll.mail.ru admin interface was not restricted. Access to static page does not grant attacker the ability to perform any actions or access any sensitive information...

Mail.ru: Account Takeover at worki.ru

One time code reuse between registration and authentication in combination with insufficient bruterofce protection allowed account access via verification code bruteforce for worki.ru. Common flaws of SMS auth: https://blog.deteact.com/common-flaws-of-sms-auth/...

Automattic: [IDOR] Attacker user can Approve/Decline AFK on the behalf of other users

Summary: Hi team Hope you are good Missing proper authorization checks on the vulnerable request allows an attacker to approve/decline afk of users on the behalf of other user who is a member of other organization. This can be exploited simply by changing the responderuserid in the vulnerable...

Open-Xchange: Unchecked URL in attachment datasource

Implementation of com.openexchange.url.mail.attachment datasource does no validation of url parameter. Any URL supported by Java's URLConnection can be read. Attached is an exploit which reads /etc/hostname file from sandbox server. Impact Any URL supported by Java's URLConnection can be read...

HackerOne: latest_activity_id and latest_activity_at may disclose information about internal activities to unauthorized users

Mini information disclosure related with team's internal comments/assign group activity id and datetime are exposed Steps: 1 As victim, Create a sandbox team and create report 2 Add attacker as a participant for the report 3 As victim, create some internal comments team -only comments /assign gro...

Zomato: [www.zomato.com] Blind XSS on one of the Admin Dashboard

Thanks for the report @pandaaaa. The Blind XSS fired when the order details were viewed by the admin at the back-end, The script was injected through an API endpoint from the Zomato app on one of the parameters which was recently introduced to provide special instructions to the restaurant on how...

Central Security Project: OS Command Injection in Nexus Repository Manager 2.x -- Bypass for Nexus Repository Manage 2.14.15-01 Command Injection fix

https://support.sonatype.com/hc/en-us/articles/360033490774 An OS command injection vulnerability has been discovered in Nexus Repository Manager requiring immediate action. The vulnerability allows for an attacker with administrative access to nxrm to execute arbitrary commands on the system. We...

Uber: Change the rating of any trip, therefore change the average driver rating

The endpoint used for rating the driver did not validate correctly if the trip corresponded to one made per user logged in, therefore knowing the tripUUID, driverUUID and userId made it possible to change the rating of any trip. Attack scenario: a bad driver with poor ratings and programming skil...

Internet Bug Bounty: Tcpdump before 4.9.3 has a buffer over-read in print-dccp.c:dccp_print_option() (CVE-2018-16229)

Tcpdump before 4.9.3 has a buffer over-read in print-dccp.c:dccpprintoption. This vulnerability was disclosed to the tpcdump maintainers and was fixed in version 4.9.3 and disclosed as CVE-2018-16229. I was credited with finding and disclosing this vulnerability:...

Internet Bug Bounty: Tcpdump before 4.9.3 has a buffer over-read in print-802_11.c (CVE-2018-16227)

Versions of tcpdump before 4.9.3 are vulnerable to a buffer over-read in print-80211.c. This vulnerability was disclosed to the tcpdump maintainers and was recently patched in version 4.9.3 and disclosed as CVE-2018-16227. I was credited with finding and disclosing this vulnerability:...

Internet Bug Bounty: tcpdump: CVE-2018-14879 - buffer overflow in tcpdump.c:get_next_file()

The release of tcpdump 4.9.3 brought many bug fixes, including one I submitted, CVE-2018-14879. The command-line argument parser in tcpdump before 4.9.3 has a buffer overflow in tcpdump.c:getnextfile. ==2288==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffe363769bf at pc...

Rocket.Chat: XSS (leads to arbitrary file read in Rocket.Chat-Desktop)

Description: Rocket.Chat allows administrative users to customize the home body. Since tags are removed, I think that running scripts should not be allowed. However, event handlers are not removed, allowing you to inject your own scripts. Releases Affected: Rocket.Chat-Desktop-Client: v2.15.5...

curl: Race condition with CURL_LOCK_DATA_CONNECT can cause connections to be used at the same time

Summary: We've seen race conditions when using CURLLOCKDATACONNECT in libcurl where sometimes two different threads using two different easy handles ends up sharing the same connection pointer at the same time. This causes UAFs and double frees when both threads are freeing items on the same...

Ping Identity: Google Maps API key leaked during device pairing

Summary: just on intercepting and going through the request i made from ort-admin.pingone.com . i found that the google map api key was leaking through get request . i was able to validate that the leaked key was a valid one Steps To Reproduce: 1.login to account goto setup tab ping iD device...

Moneybird: Bypass password reset rate limit protection at moneybird.com/passwords

Attacker found a way to completely bypass our rate limit protection, allowing for other types of attacks. This involved changing the value of the X-Forwarded-For header. Attacker never got a 429 response from our servers when the value for each request is different. Injecting X-Forwarded-For :...

Semrush: Code injection in https://www.semrush.com

INTRODUCES: -With a direct error on the homepage, it is easy to trick the victim into accessing a fake page from the attacker STEP: Step: Send url with payload to victim:...

Mail.ru: [api.pandao.ru] IDOR for order delivery address

API method in api.pandao.ru was not properly restricted and could be used to view delivery address information of arbitrary order...

GitLab: Stored XSS in merge request pages

A stored cross-site scripting XSS vulnerability was discovered in GitLab merge request pages. An attacker could exploit this vulnerability by creating a merge request with a specially crafted branch name and tricking a user with insufficient permissions to view the merge request page. This could...