Node.js third-party modules: Arbitrary File Write through archive extraction

I would like to report arbitrary file write vulnerability in adm-zip module It allows attackers to write arbitrary files when a malicious archive is extracted. More info here: https://snyk.io/research/zip-slip-vulnerability https://github.com/snyk/zip-slip-vulnerabilityaffected-libraries Module...

Node.js third-party modules: Arbitrary File Write Through Archive Extraction

I would like to report arbitrary file write vulnerability in adm-zip module It allows attackers to write arbitrary files when a malicious archive is extracted. More info here: https://snyk.io/research/zip-slip-vulnerability https://github.com/snyk/zip-slip-vulnerabilityaffected-libraries Module...

Liberapay: Csrf token does not meet security design

Almost all APIs in liberapay.com have csrf tokens.However, this token is not useful for the specified user. In the case that the user is not logged in, the csrf token is also generated, and after the login is successful, the token does not change.And the csrf tokens generated by other web browser...

Yelp: I.D.O.R TO EDIT ALL USER'S CREDIT CARD INFORMATION+(Partial credit card info disclosure)

@hk755a discovered an Insecure Direct Object Reference Vulnerability that allowed an attacker to obtain the last four digits of a credit card that has been registered with the Yelp platform, through the error messages that the /profilepayment/save endpoint returned...

Mail.ru: DNS Misconfiguration

Your localhost.mail.ru has address 127.0.0.1 and this may lead to "Same- Site" Scripting. Here is detailed description of this minor security issue by Tavis Ormandy: http://www.securityfocus.com/archive/1/486606/30/0/threaded I can also ping the localhost network from mail.ru, as in the image...

PullString: Eternal "change password" link.

Hi. Link for password change does not exprire after first use and may be reused many times, resulting password change every time. The issue is such links leak to google-analytics. I'd suggest expire link after first use. Also you store the link in Log output. This means easy leveraging XSS to...

Upserve : Insufficient validation of sides/modifiers quantity

Summary: The Upserve Online Ordering OLO application does not properly verify on the server side the number of sides/modifiers that have been added Description: Certain items allow for selection of a limited number of sides/modifiers, and the application restricts the number of sides/modifies tha...

Vanilla: Unsanitized input in email field

Users are able to inject javascript payloads in the email field which leads to stored XSS Steps to produce : 1. Go to profile and add "alert1"@example.com as your email . 2. We can see the popup at https://discuss.paytm.com/profile/preferences/profilename Impact Users can store malicious payloads...

Liberapay: Exploiting JSONP callback on /username/charts.json endpoint leads to information disclosure despite user's privacy settings

Hello! Vulnerability Details The /username/charts.json endpoint can return a JSONP callback due to the fact that jsonpdump is used in the file charts.json.spt. It appears that the content of the JSONP request depends on the authentication of the user. If the user enabled the privacy setting which...

Liberapay: REGISTRATION USING FAKE EMAIL ACCOUNT

Go to page https://liberapay.com/sign-up 2. Input email address I tried to register with some email address [email protected] [email protected] [email protected] [email protected] [email protected] 3. Select the currency you want to use 4. click "GO" button 5. Will automatically enter into account without going through the process of verification email...

Open-Xchange: [XSS] RSS Feed Widget

Hi. If type == null OR type any not htm, xhtm then data not sanitize, e.g.: - - - RssAction.java: java for SyndContent content : contents String type = content.getType; if null != type && type.startsWith"htm" || type.startsWith"xhtm" foundHtml = true; String htmlContent =...

Mail.ru: XSS at https://icq.com/people

DOM Based XSS existed in old people search subservice icq.com/people. This functionality was removed...

Open-Xchange: [SSRF] PDF documentconverterws

Hi. Previous report 260576 Example: F305199 /ppt/slides/rels/slide1.xml.rels: xml Result: F305196 Impact Scan network Read any file file:///home/example/test.odf...

OLX: Reflective XSS at olx.ph

Hello, I would like to report a reflective XSS at https://www.olx.ph. Steps to reproduce Visit the following link: https://www.olx.ph/all-results?q=car&utmsource=OptHomepageVar0&utmmedium=Search&utmcampaign=toto%27-alertdocument.domain-%27-%27 An XSS should pop-up F305078 Technical Details The...

Uber: SQLI on uberpartner.eu leads to exposure of sensitive user data of Uber partners

The Uber EU test site has a SQLI vulnerability exposing several databased and based on the database names, may expose hashed passwords and Uber partner information. Basic time-based SQLI that disclosed a database on a Uber EU test site. Check out my blog https://healdb.tech/blog/ or my Twitter...

Uber: Open AWS S3 bucket at ubergreece.s3.amazonaws.com exposes confidential internal documents and files

The Uber Greece AWS S3 bucket was open, allowing any remote user to view and download the files. Some of these files included confidential internal documents which could negatively impact Uber's brand. I found a uber microsite that had a link to this AWS bucket being used by Uber greece. Had some...

Liberapay: CSRF token manipulation in every possible form submits. NO server side Validation

Web Application is generating CSRFtoken values inside cookies which is not a best practice for web applications the revelation of cookies can reveal CSRF Tokens as well. Authenticity tokens should be kept separate from cookies and should be isolated to change operations in the account only...

Liberapay: The csrf token remains same after user logs in

Description As the CSRF token doesn't change after login. Any other user that uses the same workstation is vulnerable. A safer way would be to use dynamic CSRF token or just change the token after login, so attacker doesn't get hold of this. Details of the attacks scenario in a shared workstation...

Liberapay: Insecure Account Deletion

Hi Team, The removal of account is one of the sensitive part of a web application that needs to protect, therefore removing an account should validate the authenticity of the user, however i have found that when removing an account, the system did not require the user to input the account passwor...

Liberapay: Unsafe deserialization in Libera Pay allows to escalate a SQL injection to Remote Command Execution

Hello. There isn't a direct vulnerability, however a SQL injection would easily be escalated to a Remote Code Execution. I can't directly exploit it due to the restriction on team names it does not accept hexdecimal values. I, however, submit this issue in advance and will attempt to escalate thi...

Liberapay: Missing back-end user input validation can lead to DOS flaw

Hello Team, Usually such kind of reports are out of scope, however I still would like to report you the business logic weakness that should be eliminated, at least from my point of view. Due to missing user input validation it is can lead to application unavailability. Details: During brief revie...

Semmle: DOMXSS in redirect param

Summary The redirect param can consist of a javascript: url, which results in XSS. If a victim visits a malicious URL and logs in, the attacker can perform actions on behalf of the victim. Steps to reproduce 1 Logout 2 Visit...

Monero: Trusted daemon check fails when proxied through torsocks or proxychains

Summary: If torsocks1 or proxychains1 is enforced when using Monero wallet with a remote node without explicit --untrusted-daemon arguments given, the application will assume the daemon is trusted. Description: By default, the wallet checks if the daemon address can be trusted by calling...

Liberapay: Liberapay Non Verified Account Takeover with signup feature

Hi, So i saw a strange behaviour of your web on signup feature when that can be escalated to Account Takeover but for limited timeline, Issue: When a New user signup for an account on https://en.liberapay.com/ he have to enter his email address only and it doesn't say anything about sending a...

Liberapay: Anyone can register organization legal type as "Soletrader"

When Organization type is registered, two values are displayed : Business and Organization. When another value is provided, an error message is printed saying the Legal Type is wrong. This error message is not printed and request success when the value "Soletrader" is provided. The value...

Liberapay: CSRF ON EDITING NAME (OPTIONAL)

Allows an attacker to change one's account information in this case ie information from "Name Optional". Attackers can change the information without having to login to victim account or without having to login but only by using CSRF technique. I tried changing the "Name Optional" information to...

Liberapay: Able to View other users income history

Hello, I found an IDOR that i was able to view income history of other users, Steps to reproduce issue, 1. Login into account and fire up Burpsuite 2. The got to profile page and click on view income history 3. Then you can see a request like GET /Liberapay/charts.json HTTP/1.1 Host: liberapay.co...

Liberapay: csrf token did not changed after login/logout many times

hello team, your csrf token did not expired and after login and logout many times , i found that your csrf token is generated same as last one. Impact if an attacker found an xss on your domain and you fixed it but attacker still has csrf token of user, attacker can use it to perform any action...

Liberapay: Same CSRF token is being used for deleting other platform login’s within an account and across other liberapay Account’s

We’ve got “Accounts Elsewhere” option in the profile section. where we can connect our liberapay account with multiple other platform accounts. While deleting those Multiple other platform accounts same CSRF token is being used. I’ve signed up with a couple of liberapay accounts. Where I found th...

Liberapay: Unsecure changing password

I would like to report about changing the password. When you change the password it didn't require the current password. The scenario here is when you forgot to logout your account when you login on other device it is easy to takeover the account by changing the password of it. Impact Easy to...

Liberapay: twitter api access token leaked on github

sensitive token were leaked on GitHub page of liberapay . also mixpanel token was leaked TWITTERCONSUMERKEY=QBB9vEhxO4DFiieRF68zTA TWITTERCONSUMERSECRET=mUymh1hVMiQdMQbduQFYRi79EYYVeOZGrhj27H59H78 +TWITTERACCESSKEY=34175404-G6W8Hh19GWuUhIMEXK0LyZsy7N9aCMcy1bYJ9rI...

Liberapay: Phishing by Navigating Browser Tabs

Hi team, I was create a PR on github https://github.com/liberapay/liberapay.com/pull/1127 Details Opened windows through normal hrefs with target="blank" can modify window.opener.location and replace the parent webpage with something else, even on a different origin. While this doesn't allow scri...

Liberapay: Current CSP Policy chained with HTML Injection can lead to Data Exfiltration

Hi Team, Summary While reviewing the CSP headers for en.liberapay.com i noticed that img-src has a source set to which means any source on the internet. The following is found in the current CSP Header config. img-src blob: data: Description: If the site is vulnerable to HTML Injection its possib...

Liberapay: CSRF to make any user accept the invitation to the team

Description: The victim can be tricked into accepting the invite as a normal GET request is sent while accepting the request. Steps to reproduce Make an html page using the following code: click here Change" test" with your team mate. Impact The impact is low but still it can make a user to accep...

Liberapay: Origin IP found, Cloudflare bypassed

Hello team, during the initial assessment of your assets I've come across what seems to be the unprotected origin server for www.liberapay.com. Description The frontend currently resolves to ████ and ███, both owned by Cloudflare, which act as your reverse proxy and WAF. By correlating your SSL...

Starbucks: Information Leak - Github - JMS Information

Hi, After some research, I found a leak on GitHub that might lead to accessing sensitive data of employees or clients not sure based on the code. There is also a SAP S-user to access a cloud based HANA service. I have not confirmed what kind of data is in there to avoid potential legal issues. I...

Liberapay: Authenticated reflected XSS on liberapay.com via the back_to parameter when leaving a team.

Poc : Click the cancel button its redirect to 3rd party site. Regards, techguy Impact This vulnerability could redirect users to the attackers websites for phishing attacks...

Mail.ru: [account.mail.ru] XSS на странице восстановления пароля

При генерации формы восстановления пароля значение email подставляется туда как есть: https://account.mail.ru/recovery/support?email=%3Csvg%20onload=alertdocument.domain%3E Domain, site, application -- https://account.mail.ru/recovery/support Testing environment -- Firefox 60.0 Chrome 66.0 Steps ...

Node.js third-party modules: [markdown-pdf] Local file reading

I would like to report local file reading in markdown-pdf It allows to insert a malicious html code, which allows to read the local files. Module module name: markdown-pdf version: 8.1.1 npm page: https://www.npmjs.com/package/markdown-pdf Module Description Node module that converts Markdown fil...

Starbucks: SQL Injection Proof of Concept for Starbucks URL

browser: firefox quantum 60.0.1 64 bit os: windows 10 sqli type: char formula injection info found: oracle database system url: https://www.starbucks.de/coffee/our-coffees/format/whole-bean injected url using oracle concatenation and char functions:...

Trello: Stored XSS in Treeview plugin

There was a potential XSS issue in a third party power-up. While issues with third party apps are generally out of scope for our bug bounty program, in this case we opted to award a small bounty...

Mail.ru: [account.mail.ru] XSS на странице удаления аккаунта через backUrl

Недостаточная валидация параметра backUrl даёт возможность указать javascript-ссылку: https://account.mail.ru/user/delete?backUrl=javascript:alertdocument.domain javascript getBackUrl: function url return /^http/.testurl ? url : this.urlData.backUrl || this.config.get'backUrl' ||...

GSA Bounty: Multiple Bugs in api.data.gov/signup endpoint leads to send custom messages to Anyone

Hey there, while signing for new api key, i have found two bugs that is unusual and make anyone to send crafted or customised email to someone. Bug 1: - low 1. Go to https://api.data.gov/signup/ 2. Enter first and last name , then enter email id and get api key. Bug: You can use the same email id...

Passit: Insecure opening of external links in app.passit.io/list allows for reverse tabnabbing

Description https://app.passit.io/list renders external links under attacker control that open in a new tab such that the opened tab has access to the opening tab where the user was just browsing on app.passit.io via window.opener. This is likely due to the lack of specifying a rel="noopener"...

U.S. Dept Of Defense: LDAP Injection at ██████

Summary: An LDAP Injection has been found at the mentioned domain Description: While performing a user registration, is it possible to edit the request and inject invalid characters, resulting in a LDAP injection Step-by-step Reproduction Instructions 1. Visit page...

GitLab: Potensial SSRF via Git repository URL

Duplicate: Fixed in 8.17.4, 8.16.8, and 8.15.8 Original report: https://hackerone.com/reports/135937 SSRF when importing a project from a Repo by URL GitLab instances that have enabled project imports using "Repo by URL" were vulnerable to Server-Side Request Forgery attacks. By specifying a...

Zomato: [www.zomato.com] SQLi on `order_id` parameter

@saltedfish found that a parameter orderid was vulnerable to SQLi. POC for everyone to learn from this disclosed report - There was an endpoint which had orderid as one of the parameters. - Requesting '-if1=2,'0','1'-' in orderid parameter changed the Response Length and upon further investigatio...

Node.js third-party modules: [serve] Server Directory Traversal

I would like to report a Server Directory Traversal vulnerability in serve. It allows reading local files on the target server. Module module name: serve version: 7.0.1 npm page: https://www.npmjs.com/package/serve Module Description Assuming you would like to serve a static site, single page...

Node.js third-party modules: [serve] Stored XSS in the filename when directories listing

I would like to report a Stored XSS issue in module serve It allows executing malicious javascript code in the user's browser. Module module name: serve version: 7.0.1 npm page: https://www.npmjs.com/package/serve Module Description Assuming you would like to serve a static site, single page...

Vanilla: A SQL injection vulnerability in Vanilla

Summary: There is a SQL injection vulnerability in the vanilla, an attacker can use this vulnerability to obtain database information. Description: in applications/conversations/controllers/class.messagescontroller.php:164 php public function addMessage$conversationID = ''...