Node.js: Out of order TLS handshake / application data messages lead to segmentation fault

Summary: IMPORTANT NOTE: I have already been working with the NodeJS core security team on this issue and have provided core files, POC and many other pieces of information. I was told by James Snell to report via Hackerone to make it official however all the relevant details on this issue have...

Zomato: [Zomato's Blog] POST based XSS on https://www.zomato.com/blog/wp-admin/admin-ajax.php?td_theme_name=Newspaper&v=8.2

Issue details: POST based XSS Vulnerable URL: https://www.zomato.com/blog/wp-admin/admin-ajax.php?tdthemename=Newspaper&v=8.2 Vulnerable Parameter: loopStatemoduleId Payload: promptdocument.domain Steps to reproduce: As this is a post based you need to create a html csrf to trigger xss. HTML code...

Passit: CSV-injection in export functionality

Summary: CSV-injection in export functionality Description: Hello team! I have found that you have a CSV-injection vulnerability in export functionality. First I thought that this is just fine but because you can group up this can be used against another users which makes this pretty critical...

LocalTapiola: WordPress username enumeration (/author)

If permalinks are enabled, in many WordPress installations it is possible to enumerate all the WordPress usernames iterating through the author archives. Whenever a post is published, the username or alias is shown as the author. For example, the URL http://site.com/?author=1 will show all the...

LocalTapiola: Disclosure of Users Information via Wordpress API (?rest_route)

Summary: It's possible to get information about the users registered such as: id, name, login name, etc. without authentication in Wordpress via API on www.lahitapiolarahoitus.fi. Description: By default Wordpress allow public access to Rest API to get informations about all users registered on t...

Slack: HTTP parameter pollution from outdated Greenhouse.io JS dependency

Slack's career page was using an outdated Greenhouse JavaScript dependency which resulted in an HTTP parameter pollution vulnerability. This would have allowed the loading of external Greenhouse forms not owned by Slack. We updated the Javascript and the issue is resolved. Thanks @irvinlim! The...

Roblox: Subdomain Takeover to Authentication bypass

Vulnerability Type: ----------- Subdomain Takeover Description: ----------- Due to unclaimed or expired Hubspot instance an attacker is able to claim and serve content from devrel.roblox.com and perform different kind of attacks which i shared in impact section. Affected Area: -----------...

LocalTapiola: DoS of www.lahitapiolarahoitus.fi via CVE-2018-6389 exploitation

Description There is possibility in /wp-admin/load-scripts.php script to generate large 3Mb amount of data via simple non-authenticated request to server. The vulnerability is registered as https://vulners.com/cve/CVE-2018-6389 Details Detailed attack scenario is described for example here:...

HackerOne: Invalid Phabricator API token revealed through error message when escalating a report

Summary While trying to create a phabricator task by escalating to phabricator, error message contains the API token as a part of the pop up. This is seen when a user tries to enter an invalid API token. Description It was seen that after setting up phabricator integration in a program, when tryi...

Node.js third-party modules: [localhost-now] bypassing url filter which leads to read content of arbitrary file

Hi guys, i can bypass url filter in localhost-now module. It allows to read content of arbitrary files on the remote server. Module module name: localhost-now version: 1.0.2 npm page: https://www.npmjs.com/package/localhost-now Module Stats 26 downloads in the last week Vulnerability Description...

Greenhouse.io: Cache poisoning using NULL bytes and long URLs

This is related to a previous report I made https://hackerone.com/reports/326639. The same endpoint https://boards.greenhouse.io/embed/jobboard/js?for= is still vulnerable to arbitrary string injection, by terminating the customer key in the for parameter with a URL-encoded NULL byte i.e. %00,...

VK.com: Reflected XSS в /al_audio.php

XSS в аудио. XSS в прикреплении аудиозаписи в виджете комментариев...

Open-Xchange: Blind XXE via Powerpoint files

Summary During the parsing of Powerpoint files it seems that it is possible to include XXE payload which will be executed on the Open-XChange server. I was able to identify which files exist on the server, and cause the server make arbitrary request to my own server, and I am pretty sure it is al...

HackerOne: CSRF at [Apply to this program] that lead to submit your request automatic with out any validations

Hi , the behavior found in some of programs that need to Apply to this program like @hackthedts this program need to your submit Application before start found/send bug to them . this button have no any validations/check protect for CSRF bug , that can lead to auto apply to program by used this...

Mail.ru: Disclosure of user email address and Deanonymization [mail.ru] + Blind | Stored XSS pets.mail.ru

Stored XSS in pets.mail.ru requires manual moderation. pets.mail.ru is not covered with bug bounty program...

Mail.ru: Blind XSS pets.mail.ru/admin/

Blind XSS in pets.mail.ru admin panel. pets.mail.ru is not currently covered by bug bounty program...

HackerOne: Harvesting all private invites using leave program fast-tracked invitation and security@ email forwarding feature

Hi HackerOne, Summary: I have found a way that it is possible to harvest all private invitation using the new Leave Program feature together with the security@ email forwarding feature without any user interaction. --- Description: First, when the program activated the security@ email forwarding ...

New Relic: [NR Synthetics] Restricted User can add/modify alert conditions on monitors without any synthetics privileges

There is a privilege escalation bug that allows a user with restricted privileges to make changes to alerts on Synthetics monitors, without the proper permissions to do so in fact, they can make changes with NO synthetics permissions. In order to reproduce this it's easiest if you have two accoun...

Instacart: CSRF Trial 14 days express subscription

Description ======== When a new user has been registered, Instacart pops up a message offering the user for a limited time 14 days express trial, in which the user may decide to skip and subscribe later on decision. The research has found that the express trial subscription endpoint does not...

Razer US: Admin login page reveals user account - no anti-bruteforce

A login page's text upon a failed login could have been used to determine valid user names. The text was adjusted to avoid this...

Open-Xchange: IDOR to view other user folder name

TESTED ACCOUNT: ================= [email protected] STEP TO REPRODUCE ==================== there is IDOR in viewing other user folder name GET...

Discourse: Stored XSS in "post last edited" option

There are two users: Attacker and Victim. 2. Attacker starts a private talk via private message with the Victim. 3. Attacker send a message to Victim, then he edits it or deletes it. 4. Victim sees the yellow pencil, symbol of the edit. 5. Victim clicks on yellow pencil to see the edit and the...

Node.js third-party modules: npm packages that overlap with core node packages

Hi, I have posted here, but I wanted to make you aware of this easy social engineering trick. I do not want to claim any of these are currently malicious, but it they easily could be. Thanks, Marc Impact The attacker could do anything...use the postinstall as the user, work the same as steal data...

Slack: TURN server allows TCP and UDP proxying to internal network, localhost and meta-data services

The TURN servers used by Slack allow TCP connections and UDP packets to be proxied to the internal network. This gives an attacker the ability to scan and interact with internal systems. The attacker may proxy TCP connections to the internal network by setting the XOR-PEER-ADDRESS of the TURN...

Algolia: Directory traversal at https://msg.algolia.com

Hi, I was able to view the internal server files at https://msg.algolia.com. Please see the attached screenshots for proof. I have tried to reproduce from within firefox and internet explorer without much luck however if you need it I will try to come up with a work around. For reference the...

Reverb.com: Persistent XSS in https://sandbox.reverb.com/item/

Description I found a Persistent XSS in a listing page. The flaw is in the SoundCloud link that the listing owner can attachThe parameter is called productsoundcloudlinkattributeslink. There's no encoding on the user input and it looks like there's only client-side validation. PoC The payload:...

Mail.ru: [dl.beepcar.ru] CRLF Injection

CRLF Injection via Get request PoC: https://dl.beepcar.ru/qwerty%0ASet-Cookie:%20test=qwerty;domain=.beepcar.ru HTTP Response: HTTP/1.1 302 Moved Temporarily Server: nginx/1.12.2 Date: Tue, 03 Apr 2018 19:20:31 GMT Content-Type: text/html Content-Length: 161 Connection: close Location:...

BOHEMIA INTERACTIVE a.s.: (Possible) staff account takeover via reset token bruteforce at helpdesk.bistudio.com

As stated in a brief exchange with @rvn in my other report 312433, I might have found a logic flaw in the way https://helpdesk.bistudio.com handles the reset flow and tokens. I've asked if it was possible to obtain a test account, but I fully understand that it's something that cannot be done; as...

Ubiquiti Inc.: Bypass blocked profile protection on aircrm.ubnt.com

The researcher discovered a bypass in the "block profile publication" feature...

Starbucks: Unauthorized access to jiratest.starbucks.com

@damian89 found an unsecured JIRA instance containing internal and sensitive information. The finding was supported with detailed reporting and impact information. We immediately blocked remote access to the site and prevented anonymous users from browsing and editing issues. Thank you @damian89...

New Relic: Internal API endpoint discloses full account name of email address associated with unconfirmed user

There's an interesting thing happening with the Internal API call that lists users on an account. Based on what I can tell, it's another IDOR like █████████ in which it exposes user information of accounts that Steps to reproduce: 1. Create an account 2. As an admin, go to create a new user...

Ruby: HTTP header can split /[\r\n]/ instead of /\r\n/

https://www.ruby-lang.org/ja/news/2019/10/01/http-response-splitting-in-webrick-cve-2019-16254/...

Open-Xchange: [XSS] Pasting bootstrap in mail compose

Hi. No filter for bootstrap data attributes. data-target allow any html, e.g.: - " href="" collapse - " href="" dropdown - " href="" modal Steps: 1. Create page with this code best example with dropdown, you can use my template https://secator.com/ox/bootstrap.html 2. Ctrl+A select all, Ctrl+C co...

Vend VDP: Race Condition : Exploiting the loyalty claim https://xxx.vendhq.com/loyalty/claim/email/xxxxx url and gain x amount of loyalty bonus/cash

Hey Team! I love loyalty bonuses, that turns first time users into returning customers , but sometimes loyalty can be exploited, just like in this chase. LT:DR A firtstime loyalty customer will get x times the amount of loyalty bonus from the story by racing the loyalty link x amount of times in...

Dropbox: User Impersonation - Create Support Ticket With Any Registered Account Email

This report described a method to make support tickets look as if they came from another email address. Normally this would present a problem, however our customer support representatives will first verify the user's email address before taking any action or disclosing any information about a...

Khan Academy: https://mathfacts.khanacademy.org/ includes code from unprivileged localhost port

The webpage https://mathfacts.khanacademy.org/ contains an invalid javascript include at the bottom of the page: This is probably some unintended leftover from the development. In normal situations this will only cause the browser to be unable to connect. But it can actually become a security ris...

HackerOne: Email Forwarding invitations for Drafts are not marked as accepted, allowing multiple users to join a program after disabling Email Forwarding

STEPS TO REPRODUCE: 1. I have found a sandboxed team in hackerone,named █████. 2. The manager of that team sends an invitation to: ██████████ which email was not exist on hackerone account 3. Now the invitation link receive was ======== ████ 4. I logged in from multiple researcher account and...

Nextcloud: Extremly simple way to bypass Nextcloud-Client PIN/Fingerprint lock

I'm sorry for my bad English, I'm German How to reproduce this security bug. Step 1: Take a normal Android smartphone maybe it also works on iOS, but I have not tested it yet. Step 2: Install the official nextcloud-client. Step 3: Set up nextcloud: Open the nextcloud app, tap on "Skip", enter the...

Brave Software: Cross domain tracking even with 3rd party cookies disabled.

Cross domain tracking Default settings from Brave browser has 3rd party cookies disabled. Which I am assuming also disables 3rd part storage like IndexedDB etc. Because of this protection it is not possible for a 3rd party to track users across multiple domains. But, Even though third-party cooki...

Ubiquiti Inc.: 3x Reflected XSS vectors for services.cgi (XM.v6.1.6, build 32290)

There are certain end-points containing functionalities that are vulnerable to reflected cross site scripting XSS, allowing attackers to abuse the user' session information and/or account takeover of the admin user. Authenticated users can be persuaded to visit malicious web pages, which allows...

Nextcloud: Improper protection of FileContentProvider

Some data in the FileContentProvider is protected against applications not related to NextCloud. The application checks if calling application package name contains "com.nextcloud.client" string. Every application with such substring in package name is allowed to fully access FileContentProvider...

Shopify: Order notifications being sent for a deactivated staff account

Hi, Steps to reproduce : - - Have a staff account with settings permission - The staff account can go to notifications & add himself so as to get new order notifications - Now,deactivate the staff account via the admin. - Create a new order,you shall see that the staff still receives the order...

Node.js third-party modules: [buttle] HTML Injection in filename leads to XSS when directory listing is displayed in the browser

I would like to report HTML Injection in buttle module. Due to lack of filenames sanitization, it is possible to inject malicious iframe tag via filename and execute arbitray JavaScript code. Module module name: buttle version: 0.2.0 npm page: https://www.npmjs.com/package/buttle Module Descripti...

VK.com: Определение id по номеру телефона

Недостаточность проверок в определенных запросах...

Node.js third-party modules: [buttle] Remote Command Execution via unsanitized PHP filename when it's run with --php-bin flag

I would like to report Remote Code Execution in buttle module. When buttle is run with --php-bin option to handle PHP, the PHP filename is not sanitized and allows to inject shell commands. Module module name: buttle version: 0.2.0 npm page: https://www.npmjs.com/package/buttle Module Description...

Mail.ru: XSS on https://www.delivery-club.ru/sd/test_330933/info/

Stored XSS on www.delivery-club.ru domain. On the time of reporting, delivery-club.ru client-side vulnerabilities are not covered by bug bounty program...

Node.js third-party modules: [pdfinfojs] Command Injection on filename parameter

Hello , there is a Command Injection vulnerability on the "pdfinfojs" module. Module module name: pdfinfojs version: 0.3.6 npm page: https://www.npmjs.com/package/pdfinfojs Module Description pdfinfo shell wrapper for Node.js Module Stats 10 downloads in the last day 61 downloads in the last week...

U.S. Dept Of Defense: Information Disclosure

I discovered that due to an outdated atlassian software instance, I was able to exploit an SSRF vulnerability in confluence and was able to perform several actions such as bypass any firewall/protection solutions, was able to perform XSPA through assessing the response times for ports, access...

Mail.ru: Partner Account Takeover on https://www.delivery-club.ru через пользовательский аккаунт.

Improper access control allowed user account to perform privileged actions for partner's account with same ID. Ситуация аналогичная с 324230, но в другую сторону. Можно захватывать партнерские аккаунты посредством сессии с основного сайта...

Node.js third-party modules: [serve] Directory listing and File access even when they have been set to be ignored (using dot-slash)

I would like to report a vulnerability in serve. It allows listing directory and reading local files on the target server. Module module name: serve version: 6.5.3 npm page: https://www.npmjs.com/package/serve Module Description Ever wanted to share a project on your network by running just a...