Shopify: H1514 Remote Code Execution on kitcrm using bulk customer update of Priority Products

Hi, Background kitcrm.com allows the administrator to upload priority product images located at: https://kitcrm.com/seller/onboarding/1 F359446 F359447 These images are not being checked if they are real JPG/PNG/GIF. When uploading an ImageTragick issue found my Tavis Ormandy using the following...

Shopify: Reflected XSS on $Any$.myshopify.com/admin

Description : Hi, I have found a reflected cross site scripting vulnerability in .myshopify.com/admin through returnurl parameter . Step to reproduce : 1-Go to https://.myshopify.com/admin/authenticate?returnurl=javascript:alert100// 2-Click on reload this page 3-Xss alert message Impact Xss atta...

Chaturbate: Update Chat Allowed By Option ( without age verification )

Summary Hi Team, I am here again with one interesting issue. This issue deals with the fact that according to the policies of chaturbate, a broadcaster cannot modify the option - Chat Allowed By - until and unless he/she has verified his/her age default choice is set to all. This thing could be...

Alliance of American Football : attacker can book unlimited tickets in free at https://aaf.com/checkout/order-received/21237/?key=wc_order_5bbef48fa35b2

Dear Team, Summary: add summary of the vulnerability After looking into https://aaf.com/ i get to know that there is way where i can book a ticket and can play around , but it asked for valid credit card and all stuff so , i tried to bypass and bought a ticket 23 with 0$ Live PoC:...

Shopify: H1514 Simple phishing using auto-created modal with weak URL-pattern check in incontext_app_link

Hi, This is unrelated to the Twine-template issue reported earlier as this would still be an issue if the template escape would be fixed. Background The incontextapplink is checked server-side if it's a correct shopifycloud.com-URL. The problem however is that userdata inside the URL is allowed. ...

Shopify: H1514 DOMXSS on Embedded SDK via Shopify.API.setWindowLocation abusing cookie Stuffing

Hi Team! I'm reporting a rather unusual DOMXSS that allows an attacker to perform a XSS attack on any Shopify apps that use the Embedded SDK. To exploit this, several techniques were chained together: Cookie Stuffing - Login CSRF - Not Open Redirect - DOMXSS. Details Inspired by 381192, I decided...

Shopify: H1514 [*.(my)shopify.com] - Viewing Password Protected Content

Hi guys! When administering a shop, the owner has the ability to preview his shop with various themes. When previewing, a unique link is generated, which the owner can share with various people without any authentication. The generation of that unique link does not require authentication, which...

Shopify: H1514 Deanonymizing Exchange Marketplace private listings

Summary: Exchange Marketplace allows Shop owners to sell their business in a easy way. When placing the shop in the listings, the owner has the option to place their store as a private listing - where only stats will be displayed, and no information about the actual Shop, domain name or shop owne...

Infogram: possibility to create account without username

hi , infogram.com doesn't allow us to go next untill we give name of our account but i bypassed that. i am able to create an account without any name, just by modify response field. steps:- 1. create new account , when you reach page where you have to give your name. 2. give name and intercept th...

Shopify: H1514 Stored XSS in Return Magic App portal content

Summary: Stored XSS vulnerability was found in return magic app portal content which executes in the application domain in https://services.alveo.io/dashboard-shopify/settings/portal/content Description: It's been found that Return Magic app allows users to add HTML content to their return portal...

QIWI: Возможность регистрации на сайте qiwi.com на любой номер телефона

Summary При регистрации на сайте qiwi.com присылается один и тот же код подтверждения в СМС. Impact Возможность зарегистрироваться под любым новым пользователем за счет перебора кода из СМС...

shopify-scripts: Crash in mrb_ary_push

PoC === The following demonstrates a crash: def methodmissing end .00 %= begin0=0 00end Debug info ========== The crash happens in mrbarypush: 495│ mrbarypushmrbstate mrb, mrbvalue ary, mrbvalue elem 496│ 497│ struct RArray a = mrbaryptrary; 498├─ mrbint len = ARYLENa; gdb p a $1 = struct RArray...

HackerOne: Unauthenticated user can upload an attachment to the last updated report draft

The newly launched beta embedded submissions form introduced the concept of anonymous submissions. When an anonymous user starts writing a report through an embedded form, a UUID will be generated to track their submission. Any object that is created will reference this UUID. We call this a trace...

Khan Academy: Cross-Site Request Forgery (CSRF) vulnerability on API endpoint allows account takeovers

Summary The /signup/email API endpoint at khanacademy.org is vulnerable to Cross-Site Request Forgery CSRF attacks, allowing takeovers of accounts associated with unconfirmed email addresses. Description The vulnerable endpoint allows an authenticated user to change the email address associated...

Shopify: H1514 [beerify.shopifycloud.com] GraphQL discloses internal beer consumption

Hi security team, Summary: With great pleasure we would like to report that we have discovered a GraqhQL endpoint that discloses internal beer consumption at your offices. Description: This endpoint is leaking internal app details about how much beer you have left on any given day. Steps To...

New Relic: [NR Alerts/Synthetics] IDOR through /policies.json with Synthetics exposes full name of other NR users

This is a similar IDOR that I've reported in the past - but I've found a bypass through a misconfiguration requiring pre-setup in both Alerts and Synthetics to work correctly. I'll show you what I mean: Steps to Reproduce From new user creation page: 1. Add a new user to the account...

Mail.ru: XSS in e.mail.ru

XSS via dom clobbering on message reply composing...

Zomato: [www.zomato.com] Blind XSS in one of the Admin Dashboard

@sandeephodkasia identified a Blind XSS vulnerability that fired in one of our admin dashboard. POC - @sandeephodkasia added "alert0; XSS Hunter was used in this case in address field while placing an order. - XSS triggered when one of our support agent viewed the order details. Thanks...

Uber: Client secret, server tokens for developer applications returned by internal API

@appsecurein identified an internal API for https://riders.uber.com that could return clientsecret and server token for applications authorized by the account owner to access their Uber account. We restricted the data returned by this endpoint. Thanks for bringing this to our attention,...

Mail.ru: Bypass security fixes by downgrading version of application

Version downgrade attack was possible in webagent web application webagent.mail.ru. It could allow attacker to force user to visit an older version of web application with known vulnerabilities...

U.S. Dept Of Defense: SQL Injection in ████

Summary: There is an SQL injection vulnerability in the SSN field at https://██████████/████/candidateapp/statusscholarship.aspx Impact An attacker could use this vulnerability to control the content in the database, exfiltrate information, and potentially obtain remote code execution. Step-by-st...

Zomato: Reflected XSS on developers.zomato.com

There is a vulnerability in https://developers.zomato.com/documentation due to an old version of Swagger UI Step to reproduce: - Create an endpoint containing : json "swagger":"2.0","info":"description":"This is a sample server Petstore server. You can find out more about Swagger at...

HackerOne: Hacker can bypass 2FA requirement and reporter blacklist through embedded submission form

Hi Team, Summary: A program owner can enforce the hackers to setup the two-factor authentication before submitting new reports to their program here: https://hackerone.com/parrotsec/submissionrequirements see below image F355169 The Parrot Sec program has this feature enabled to enforce the hacke...

Django: Email Spoofing Possible on djangoproject.com Email Domain

Summary: Due to lacking a SPF and DMARC record it is possible to spoof emails from djangoproject.com. This could potentially be used to trick employees, customers or clients via phishing emails. Description: Mail servers rely on both SPF and DMARC to properly deal with email spoofing. SPF shows...

HackerOne: Disclosing a private program in an external link if program is paused

Summary: Hi team Description: If the program is paused that we will not be able to send reports to this program and if we try to directly contact the link https://hackerone.com/externalprogrammpaused/reports/new we will be returned to the main page https://hackerone.com/externalprogrammpaused Ste...

8x8: [CRITICAL] Remote code execution on http://axa.dxi.eu

The application allowed for upload of a file with PHP extension that when loaded on the server would evaluate embedded php source...

Mail.ru: Найден build.sh в webagent.mail.ru

Source code of build script for web application was available for download. It could leak some non-sensitive information on internal build processes and configurations...

8x8: Stored XSS agent_status

The functionality to set a user's status within the ContactNow application did not perform sufficient encoding when displayed to other user's of a given organization...

8x8: Bypass Email activation on http://axa.dxi.eu

The account activation link utilized by the ContactNow application utilized a token in the existing session for validation. Knowing this token it was possible to bypass the activation step...

Chaturbate: Unrestricted POST request size on roomlogin endpoint

POST requests to endpoint /roomlogin/ are not limited in size. While the main website login endpoint correctly limits the size of request, this endpoint does not. This can be a mean to perform a DOS attack. Steps To Reproduce: 1. has a password-protected stream. 2. Send a large POST request to...

8x8: Post based XSS (Cross site scripting) on https://apimgr.8x8.com

The legacy API endpoint utilized an outdated version of WSO2 Data Analytics Server that contained a known XSS vulnerability...

Chaturbate: No rate limiting in starting up a bot.

hi security team, I was able to start up a bot numerous times. 1. Goto https://chaturbate.com/b/username 2. Choose a bot and capture the request. 3. Send to intruder and repeat the step numerous times. 4. I did this 196times 5.I was able to activate a bot numerous times 6. My room was flooded wit...

Chaturbate: No rate limiting in changing room subject.

Before i shed more light on this: I noticed i can create over 200 apps but i don't really know how valid that was. I want to report that there is no rate limiting in changing room subject. Attacker scenrio: 1. Navigate to https://chaturbate.com/b/your username 2. Try to create a room subject and...

Cloudflare: DOM XSS on 1.1.1.1(one.one.one.one)

After discussion with Cloudflare on twitter I'm reporting this here. There is a DOM XSS on 1.1.1.1 or one.one.one.one site, it seems like the sink is XMLHR.open,Taint,,, and the source is location.search The PoC url's are: https://1.1.1.1/?ApiLocation=//localdomain.pw...

Shopify: H1514 Lack of access control on edit packing slip template

Summary: An admin is able to edit the Edit packing slip template at /admin/settings/packingsliptemplate. However, a staff user with only "Home" permission and none other can view and also make edits to this template. Description: The Edit packing slip feature exists so an admin user can customize...

Monero: Locked_Transfer functional burning

Summary: Using the lockedtransfer command in the monero-wallet-cli users can send outputs with high lock times like 1,000,000 blocks. A vendor will accept these transactions with no warnings and credit a user balance. The user can now withdrawal or sell this balance and the vendor is left with...

Chaturbate: Cross-origin resource sharing: arbitrary origin trusted on chatws25.stream.highwebmedia.com

Very low-quality reports, such as those which only contain automated output, will be rejected. Summary Hi, i was able to discover a number of instances on chatws25.stream.highwebmedia.com were the application accepts an arbitrarily supplied origin. The application implements an HTML5 cross-origin...

HackerOne: Revoking user session in https://hackerone.com/settings/sessions does not revoke the GraphQL query session

Hi Team, Summary: I have found an Insufficient Session Expiration on implementation of the new Revoke user session feature of HackerOne here: https://hackerone.com/settings/sessions Description: The new REVOKE session feature will destroy the session of the selected device, that means any request...

Starbucks: Thailand - a small number of SMB CCTV footage backup servers were accessible without authentication.

radoooz discovered that a small number of SMB servers in Thailand that hosted CCTV footage and images were accessible without requiring authentication. @radoooz — thank you for reporting this vulnerability and confirming the resolution...

Shopify: Using GraphQL, STAFF with NO explicit permissions on Store can retrieve Shopify Payments Balance.

Hi, I am reporting this because it looks like a authorization bug in GraphQL. A staff member having no explicit permissions on a Shopify Store may be able to retrieve the Current balances in all currencies for the account for Shopify Payments. Steps 1. STAFF account is created and assigned NO...

Shopify: H1514 Removed Staff members who had "Apps" permission can still modify flow app connections

Summary: It's been found that removed staff members who had "Apps" permission can still modify flow app connection settings due to improper authorization. Description: Flow app https://apps.shopify.com/flow allows users to connect their Google Sheets, Trello and Asana accounts to their flow...

Shopify: H1514 CSRF in Domain transfer allows adding your domain to other user's account

Summary: Shopify allows users to buy their own domain from the Shopify system. One of the facility on this is that if you buy the domain through Shopify, you can do an inter-store transfers. This means: You can only transfer your domain to a Shopify store owned by you. It can take up to 24 hours ...

Pornhub: Single User DOS by Poisoning Cookie via Get Parameter

The researcher was able to exploit a cookie poisoning attack against other users, by sending malicious links to the victims, as a result, the victims were no longer be able to access www.pornhubpremium.com...

Chaturbate: Missing Rate Limitation at /apps/upload_app/

Summary I discovered that one is able to create unlimited number of apps via /apps/uploadapp/ . PS: I feel this is within the scope of your program and you want to know about it. If otherwise, I'll be happy to close this. Steps To Reproduce: 1. Login and go to https://chaturbate.com/apps/uploadap...

Chaturbate: CSRF on change video thumbnail at https://chaturbate.com

Hi I noticed Changing video thumbnail option have the workflow with GET request and there is lack of csrf token on changing video thumbnail option,so if attacker somehow able to obtain the thumbnailid of victim's video then it can help attacker to inducing victim to change video thumbnail...

Chaturbate: A 10GB file is reachable

Summary A file is 10GB is accessible on the following server: http://edge193.stream.highwebmedia.com:8080/. Steps To Reproduce: 1. Open the following link: http://edge193.stream.highwebmedia.com:8080/download Additional notes: I tried to download the file and analyze it, but after 20 seconds the...

Monero: DoS for remote nodes using Slow Loris attack

Summary: Using the slow loris attack it's possible to make the the daemon unresponsive to all RPC requests without at least a restart. Description: I used this node.js application https://www.npmjs.com/package/sloww to perform the attack on one of my remote nodes, but any other implementation of...

Shopify: subdomain Takeover at blog.exchangemarketplace.com

Hi , I believe that exchangemarketplace.com is belong to shopify it was vulnerable to Subdomain Takeover so I takeover it to my shopify store Poc : goto blog.exchangemarketplace.com Suggested fix : clear your subdomain dns Impact Subdomain Takeover...

h1-5411-CTF: MemeCTF serial exploitation to local file read to Papertrail access via API-token leakage and more

Hi there dear CTF staff! First of all a huge thank you for the great challenge you put up! I've found it super exciting and the learning curve has been steep. For this case, I was first wondering if this is a part of the actual CTF, but after some inspecting, it surely doesn't seem so! I did even...

Brave Software: Field Day With Protocol Handlers

Summary ===================== When launching a protocol such as mailto:, SEARCH:, or bitcoin:, Brave only asks to allow the protocol to be opened by an external application. You can select on whether or not to remember the decision or not and to allow or deny it. The issue is that upon selecting...