Node.js third-party modules: Privilage escalation with malicious .npmrc

Hello. I'm forwarding to you my conversation with npm staff regarding security issue. It allows to escalate to root privilages of victim using either: a basic social engineering - convincing victim to run npm in attacker-controlled folder eg. repository, including such innocent ones like "npm hel...

Nextcloud: File access control rules not enforced on image files

Installed Nextcloud from Snap package version 13.0.2snap1, revision 6916 on fresh Ubuntu 18.04 LTS install. 2. Installed and enabled Files access control v1.3.0 and Files automated tagging v1.3.0 apps. 3. As an administrator created an invisible collaborative tag Secret. 4. Added Files automated...

Yelp: CRITICAL Insecure Direct Object Reference (I.D.O.R) - Link Other User's Credit Card

@hk755a discovered an Insecure Direct Object Reference Vulnerability that allowed an attacker to associate a randomly added but subsequently deregistered credit card with their own account, via the /rewards/signup endpoint. While the attacker would not have been able to use this credit card as...

DuckDuckGo: SSRF in proxy.duckduckgo.com via the image_host parameter

Description https://proxy.duckduckgo.com/iur/ endpoint is vulnerable to ssrf via imagehost get parameter. Vulnerable URL: https://proxy.duckduckgo.com/iur/?f=1&imagehost=https://tudomanyok.hu/ Some internal URL: https://proxy.duckduckgo.com/iur/?f=1&imagehost=https://127.0.0.1:18091/...

Node.js third-party modules: [buttle] Path traversal in mid-buttle module allows to read any file in the server.

Hello Node.js third-party modules I would like to report path traversal in buttle module It allows me to read any file in the server if i know the path. Module module name: buttle version: 0.2.0 npm page: https://www.npmjs.com/package/buttle Module Description Simple static file + markdown server...

Nextcloud: Disclosed Version of PORTS SSH|HTTP|SSL

I found Version of ports are disclosed ,But the intersting that SSH port is open and showing his version == OpenSSH 7.2p2 Ubuntu 4ubuntu2.4 Ubuntu Linux; protocol 2.0 F:302383 Searching I have found that this version has common vulunrablitie https://vuldb.com/?id.89622 So it's not good to disclos...

Automattic: RCE via Print function [Simplenote 1.1.3 - Desktop app]

In Simplenote 1.1.3 - Desktop app there is a stored XSS vulnerability that can be used to execute arbitrary code. If there is malicious code in the note and the user tries to print it for example to save it as a PDF, the malicious code runs. This report is based on the report 291539, by Yasin...

Bumble: Compromising the user ID

Vulnerability allows to compromise the user ID in the "Dating" menu. This is a serious vulnerability that violates the logic of the site and allows the attacker to write a message to the user he likes before the user responds reciprocally. In order to play the vulnerability, you need to go to the...

Tor: Tor Browser: iframe with `data:` uri has access to parent window

Version: 7.5.4 based on Mozilla Firefox 52.8.0 Tested with standard security slider. However, it's likely to be possible with a higher security level. Summary In Tor Browser iframe with data:uri inherits the origin of parent window. That leads to iframe has access to parent window. PoC Iframe cou...

GitLab: HTML TAG INJECTION ON PROFILE NAME

Allows me to change the profile name to an image tag and convert it into an html code and this tag appears perfectly on the "snippets" page. Suppose I include an image tag with source and when another user sees it on the "https://gitlab.com/snippets/1718284" page it will appear an image of an...

Mail.ru: Clickjacking Vulnerability on https://support.my.com/games/ticket/xxxx/

Hi There, I have found a Clickjacking vulnerability on your site. Steps to reproduce: 1.Go to https://support.my.com this site 2.Generate a Clickjacking script, save it as .html and run into your browser Script: iframe width: 800px; height: 500px; position: absolute; top: 0; left: 0; filter:...

Valve: Deleting other people's comments on ModeratorMessages

Due to a missing permissions check, anyone could delete a comment on a community moderator message knowing the unique comment GID and the SteamID of the message receiver. The endpoint has been corrected to verify the correct permissions. You were able to delete others people's comments on moderat...

Reverb.com: Items bought for free due to lacks of quantity controls

Hi, The server fails to check the quantity of the items that are going to be sell. Values = 0 are accepted as 1. PoC: Go here https://sandbox.reverb.com/fr/item/139897-fender-2-strap-leather-test-2018-leather Intercept the response after clicking "Add to cart" and put "quantity: 0" F302179 Procee...

Monero: forum.getmonero.org Shell upload

Summary: The method uploadProfile in the UsersController allows an attacker to upload a shell to the target server due to lack of image validation. Description: Steps To Reproduce: 1. Open POC https://forum.getmonero.org/uploads/profile/lNobodyl1527340454.php or...

Brave Software: DoS in Brave browser for iOS

Summary: Attacker could initiate DoS during page loading. Products affected: 1.6 18.05.17.13 Device iPhone 6s iOS 11.3.1 Steps To Reproduce: PoC: html let o = document.body.appendChilddocument.createElement'object'; // application/json or application/pdf are valid values too o.type = 'text/html' ...

Passit: Old sessions does not expire On changing password via https://app.passit.io/account/change-password

Description : On changing password only current session using which user changes password only that expires however old sessions in any other browser or device does not expire and remains active. Reproduction Steps : To verify the issue : 1. Log in to Browser A and make sure to check 'stay logged...

HackerOne: Exposing hackerone users personally identifiable information by abusing sandbox with swag reward enabled

Hi HackerOne Team, Summary: I have found a critical bug but this will require a bit user interaction, BUT please take note that once exploited, a hackerone user's PII - personally identifiable information can be exposed. I have found this bug by using the sandbox with swag reward enabled . --- Le...

HackerOne: Hacktivity of a private program visible to banned user if he gets invited to a program by hackbot

Summary: The hacktivity of a private program is visible to banned user if he gets invited to a program by hackbot. Description: Back in 2016 i was banned by █████'s private program ███ due to some conflict between me and their security team, i think they manually put me in banned users list, but...

Mail.ru: Получаем все домены и поддомены icq с помощью amazonaws.com [config,txt]

Открытый доступ к config.txt на амазоне где лежат все ваши домены и поддомены "api.icq.net": "api.ic2ster.com", "bos.icq.net": "bos.ic2ster.com", "api.login.icq.net": "apilogin.ic2ster.com", "icq.com": "www.ic2ster.com ", "www.icq.com ": "www.ic2ster.com ", "files.icq.com": "files-com.ic2ster.com...

Node.js third-party modules: [simplehttpserver] List any file in the folder by using path traversal.

I would like to report Path Traversal in simplehttpserver. It allows to list any file in another folder of web root. Module module name: simplehttpserver version: 0.1.1 npm page: https://www.npmjs.com/package/simplehttpserver Module Description 'simpehttpserver' is an simple imitation of python's...

Node.js third-party modules: [exceljs] Possible XSS via cell value when worksheet is displayed in browser

Hi Team, I would like to report Stored XSS vulnerability in exceljs module. It allows to execute JavaScript code embeded in the XLS sheet when data from the sheet are displayed in the browser. Module module name: exceljs version: 1.4.6 npm page: https://www.npmjs.com/package/exceljs Module...

Open-Xchange: command Injection in rawlog binary

Quick Overview I have found a Command Injection vulnerability in the code where a method calls an OS Shell command using an untrusted string to execute. Introduction Command injection is an attack in which the goal is execution of arbitrary commands on the host operating system via a vulnerable...

Slack: Internal SSRF bypass using slash commands at api.slack.com

@albatraoz found a bypass to report 61312, allowing information leakage via SSRF in Slash commands. We fixed the vulnerability and performed a through investigation. Thanks @albatraoz!...

Open-Xchange: Buffer overflow in sha3

Quick Overview I have found a Buffer Overflow OutOfBand vulnerability in the code where a buffer used is not properly verified before writing data to the buffer. Introduction Buffer overflow attacks, in their various forms, could allow an attacker to control certain areas of memory. Typically, th...

Open-Xchange: [XSS] content_disposition=inline in files

Hi. No filter for application/ when contentdisposition=inline PoC: - 1. Auth https://sandbox.open-xchange.com/ajax/share/021f28560fbe7d5b21f28d3fbe7d42379932c8eb965ee141/1/8/NTc/NTcvMzQ4 2. XSS...

HackerOne: HackerOne support disclosing report state without checking user identity

How was i able to to know the state of report using Hackerone Support: I was able to know the state of report using different email address by contacting Hackerone Support. So the thing is this is my report https://hackerone.com/reports/344238 which is not even disclosed and closed as informative...

Phabricator: The "Download Raw Diff" URL is viewable by everyone

mongoose This is similar to 213942, but less severe. Here is what you said in 213942: The change makes us write files with narrow permissions instead of broad permissions, write temporary files instead of permanent files and ... If I understand your comment correctly, suppose that an Administrato...

Mail.ru: Раскрытие серии/номера паспорта и снилс пользователя lootdog.io

Passport data is reflected back to user and can be accessed in the case of account or session compromisation. Now passport information is not stored by lootdog.io after validation and can not be accessed by user...

Node.js third-party modules: Samlify is vulnerable to signature wrapping

I would like to report a signature wrapping weakness in samlify It allows an attacker to modify a SAML token received from the IdP before validating it with the service provider Module module name: samlify version: 2.3.7 npm page: https://www.npmjs.com/package/samlify Module Description Highly...

LocalTapiola: Wordpress Users Disclosure (/wp-json/wp/v2/users/)

Information Using REST API, we can see all the WordPress users/author with some of their information. Step TO Reproduce You can get user info by entering below url in your browser: https://www.lahitapiolarahoitus.fi/wp-json/wp/v2/users/ Result javascript "id": 1, "name": "LTR", "url": "",...

Passit: Missing HSTS (Strict Transport Security)

Added HSTS headers...

Mail.ru: Раскрытие IP, почты и другой полезной информации lootdog.io

After the deal, service was disclosing some unnecessary counterparty's information IP address and e-mail...

Yelp: CRITICAL-CLICKJACKING at Yelp Reservations Resulting in exposure of victim Private Data (Email info) + Victim Credit Card MissUse.

Please have a look at this interesting article with precise explanation about Click-jacking security flaw: https://www.linkedin.com/pulse/20141202104842-120953718-why-am-i-anxious-about-clickjacking/ In Yelp platform the response headers of the Reservation page does not contain the X-Frame-Option...

Mail.ru: Modifying application settings via clickjacking on o2.mail.ru

It was possible to edit application information or delete application via clickjacking on o2.mail.ru...

WordPress: XSS on support.wordcamp.org in ajax-quote.php

Hi, There is an XSS vulnerability in ajax-quote.php on http://support.wordcamp.org. It can be demonstrated with the attached POC - this needs to be run in Firefox to execute, as it's super basic and XSS Auditor will catch it but with multiple parameters, even with one of them filtered, it's likel...

PullString: Open redirect at staging.pullstring.com

Hi Request http GET //%2fxgoogle.com HTTP/1.1 Host: staging.pullstring.com Accept: / Accept-Language: en User-Agent: Mozilla/5.0 compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0 Connection: close Response http HTTP/1.1 301 Moved Permanently Content-Type: text/html; charset=utf-8 Date...

Avito: Open Redirect via login avito.ru | Protection bypass

Open-redirect using the following vector and social auth: https://www.avito.ru/rossiyalogin?next=///...

Node.js third-party modules: [servey] Path Traversal allows to retrieve content of any file with extension from remote server

Hi Team, I would like to report a partial Path Traversal in servey module. It allows to read content of any arbitrary file with extension from the server. Module module name: servey version: 2.2.0 npm page: https://www.npmjs.com/package/servey Module Description A static & single page application...

Node.js third-party modules: [statics-server] XSS via injected iframe in file name when statics-server displays directory index in the browser

Hi Team, I would like to report HTML Injection in statics-server module. It is possible to inject malicious iframe tag via filename and execute arbitray JavaScript code. Module module name: statics-server version: 0.0.9 npm page: https://www.npmjs.com/package/statics-server Module Description npm...

Node.js third-party modules: [statics-server] Path Traversal due to lack of provided path sanitization

Hi Team, I would like to report Path Traversal in statics-server module. It allows to read content of any arbitrary file from the server. Module module name: statics-server version: 0.0.9 npm page: https://www.npmjs.com/package/statics-server Module Description npm install statics-server -g Go to...

Uber: Reflected XSS in https://eng.uberinternal.com and https://coeshift.corp.uber.internal/

The base parameter of /oidauth/prompt on multiple uberinternal.com subdomains was not sanitized before being reflected into the page body, making it vulnerable to reflected XSS. Additionally, these pages were affected by a clickjacking vulnerability that made exploitation easier, since a click wa...

Valve: Suspended users can bypass UGC upload ban

Community-banned users could potentially upload UGC, though not associated with specific Steam games...

Internet Bug Bounty: [CVE-2018-6913] heap-buffer-overflow in S_pack_rec

pack may cause a heap buffer write overflow with a large item count. Reported to the Perl security mailing list on 5 Aug 2017. Confirmed as a security flaw by TonyC on 30 Jan 2018 CVE-2018-6913 assigned to this flaw on 11 Feb 2018 Public security advisory released on 14 April 2018...

Passit: X-Content-Type-Options has not been set at app.passit.io

Hi The Http Header X-Content-Type-Options is missing. Impact Your website http://app.passit.io/ doesn't have a header settings for X-Content-Type Options which means it is vulnerable to MIME sniffing. The only defined value, 'nosniff', prevents Internet Explorer and Google Chrome from MIME-sniffi...

Rockstar Games: stored XSS (angular injection) in support.rockstargames.com using zendesk register form via name parameter

In this report, the researcher discovered that registering for our Support site using the Zendesk Registration Form allowed for entering an AngularJS Template Injection payload as the Username. This could have allowed an attacker to perform Stored XSS attacks or similar. We deployed a fix for thi...

Vanilla: Vanilla SQL Injection Vulnerability

Summary: There is a SQL injection vulnerability in the vanilla, an attacker can use this vulnerability to obtain database information. Description: We download the program from https://github.com/vanilla/vanilla and install. In applications/dashboard/controllers/class.profilecontroller.php:274 ph...

Valve: Unfiltered input allows for XSS in "Playtime Item Grants" fields

Enter "test in any of the 3 fields, save it and reload the page. Impact Stored XSS, could possibly break some internal features too as the stored value is not an integer. The hacker selected the Cross-site Scripting XSS - Stored weakness. This vulnerability type requires contextual information fr...

HackerOne: People who interviewed for HackerOne security analyst position can be enumerated and their personal email address may be exposed

Summary: It's possible to gather basic information on potential employees at the very least who interviewed via old sample reports not being removed from the program Description: This report is meant to provide awareness of potentially private data being accessed by potential candidates. When giv...

Reverb.com: XSS in buying and selling pages, can created spoofed content (false login message)

Previously this issue was resolved at another location in report 351376 After spending more time searching the website, I found additional areas where this problem persists: https://sandbox.reverb.com/my/buying/orders?query= https://sandbox.reverb.com/my/selling/listings?query=...

Grab: Subdomain Takeover Via Insecure CloudFront Distribution cdn.grab.com

Good day, I truly hope it treats you awesomely on your side of the screen : I have found that your website cdn.grab.com is pointed via a cname to a cloudfront instance cdn.grab.com = .cloudfront.net This was not registered on Amazon Aws Cloudfront. I was able to take over the domain: See my POC P...