Open-Xchange: IDOR allow to extract all registered email

STEP TO REPRODUCE ============================= vulnerable request.... PUT /appsuite/api/user?action=list&columns=1%2C20%2C500%2C501%2C502%2C505%2C524%2C555%2C606%2C614&session=144ebd4f736c475f9e7d681c07a6a50a&timezone=utc HTTP/1.1 Host: sandbox.open-xchange.com User-Agent: Mozilla/5.0 X11; Linux...

Mail.ru: XSS уязвимость

Reflected XSS in https://account.mail.ru/signup via URI GET parameters...

Ruby: The possibility that unintended file operation may be performed because some methods of `Dir` do not check NULL characters.

It seems that entries,new, and empty? do not check NULL characters in methods of Dir. log vagrant@localhost $ ls test vagrant@localhost $ irb irbmain:001:0 Dir.open"/home/vagrant\0xxx" do |d| irbmain:002:1 p d.read = "." irbmain:003:1 p d.read = ".." irbmain:004:1 p d.read irbmain:005:1 p d.read...

Ruby: Unintentional file creation caused at Tempfile with directory traversal

The Tempfile argument of basename can use ../ without escaping. Therefore, directory traversal may occur and unintended files may be generated. create file patern log vagrant@localhost $ ls . vagrant@localhost $ irb irbmain:001:0 require 'tempfile' = true irbmain:002:0...

Cloudflare: // (double slash) inside es6 template literals interpreted as an inline comment by the auto-minifier

The following is valid javascript: var a = //; So is this: var url = https://hackerone.com; However, Cloudflare's auto-minifier removes the parts of both lines including and after the //, meaning in production, they look like this: var a = var url = https: This can either straight up break or...

ok.ru: Очень жесткая XSS в личных сообщениях m.ok.ru

Приветствую. Нашел багу в личных сообщениях в мобильной версии F251208 Что нужно, чтоб заюзать: 1. Переходим в группу https://m.ok.ru/group/54904397693159/market 2. Ищем товар единственный на страничке F251213 3. Переходим на него и нажимаем на кнопку "Связаться с продавцом"...

Paragon Initiative Enterprises: Airship: Persistent XSS via Comment

Affected: Airship 2.0.0 commit 15bdc0d CVSS ---- Medium 6.1 https://www.first.org/cvss/calculator/3.0CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Description ----------- The "name" field of a comment on a blog post is vulnerable to persistent XSS. When replying to a comment, the comment name is...

GitLab: SSRF vulnerability in gitlab.com webhook

1、 Login to your GitLab account and create a new project, then go to--https://gitlab.com/username/project/settings/integrations 2、 You can add url to ssrf.following are the steps to reproduce: If you enter http://127.0.0.1:80/haha.txt as url,we will get --Hook executed successfully but returned...

Mavenlink: CSRF Add user templates

Reproduction: ========== - Log in to account - Visit CSRF page below note default 30 seconds timeout, can be adjusted according to the connection speed: var a = window.open"https://app.mavenlink.com/projecttemplatesnew", "csrf", "height=100,width=100"; var intervalID = setTimeoutfunction a.close;...

HackerOne: Path traversal leading to limited CSRF on GET requests on two endpoints

Hi team! I've found more endpoints which are vulnerable to the limited CSRF stated in report https://hackerone.com/reports/99708. The endpoints cause a CSRF over GET requests, however, I've been unable to exploit it. The following endpoints are vulnerable to this: Proof of Concept 1. Visit...

Starbucks: Leaking sensitive files on Github leads to internal files (python scripts,SQL files)

@samidrif discovered a source repository containing sensitive and internal development information including Starbucks code and documentation. @samidrif delivered a quality report detailing his find, suspected impact, and suggestions for remediation. The repository was removed and necessary...

Snapchat: Bitmoji source code is accessible

hi team, I'm starting my research on snapchat by scanning all sub-domains on all the domains in-scope: snapchat.com, bitmoji.com, etc. Let's look at one of the urls, https://rendering-service.prod.us-east.bitstrips.com/ When I request GET https://rendering-service.prod.us-east.bitstrips.com/ The...

Mail.ru: XSS on e.mail.ru via postMessage

URI Get parameters based XSS in https://e.mail.ru/cgi-bin/login via combination of factors controllable script name via NUL characters inection, availability of script with known vulnerability within domain...

ownCloud: OS Command Injection via tainted PATH environment variable in findBinaryPath

The PATH environment variable is passed to the find command in owncloud/core/blob/master/lib/private/legacy/helper.php on line 543 is not sanitized for input. If an adversary is able to taint the PATH environment variable, OS command execution is possible utilizing the find command's execute -exe...

QIWI: https://fundl.qiwi.com CSRF на подтверждении sms

Доброго времени суток. Я тут нашел достаточно серьезную CSRF, как мне кажется. Она позволяет привязать номер телефона злоумышленника - угнать деньги. И основана она отчасти на старой CSRF, которую я репортил совсем недавно https://hackerone.com/reports/300676 Так вот, тогда я не доглядел еще одну...

LocalTapiola: Reflected XSS Vulnerability in https://www.lahitapiola.fi/cs/Satellite

Basic report information Summary: Reflected XSS vulnerability in https://www.lahitapiola.fi/cs/Satellite. Description: There exists a reflected XSS vulnerability in https://www.lahitapiola.fi/cs/Satellite?pagename=TAMaster/FWBlogAsset/FWNav. Value of query string parameter rendermode is not...

VK.com: CSRF на "ловлю гостей" и раскрытие аудиотрансляции в частной группе

CSRF в аудио. Уязвимость позволяла узнать ID пользователей, которые попались на CSRF, и так же можно было узнать песню, которая транслируется в частной группе. /alaudio.php?act=agetaudiostatus не имел hash добавлял юзера в список слушателей и показывал песню, если она шла в частной группе...

Concrete CMS: Host Header Injection allow HiJack Password Reset Link

The issue reported in 59666 and in 226659 is still applicable as originally reported, however it is tracked as an "informative" issue that can be resolved simply with proper webserver configuration or by configuring concrete5 to force a "canonical url"...

VK.com: CSRF на установку своей почты к аккаунту.

CSRF при привязке почты к странице. ВНИМАНИЕ ВКОНТАКТЕ КИНУЛИ МЕНЯ НА ВЫПЛАТУ И СКАЗАЛИ ЧТО Я ЭКСПЛУАТИРОВАЛ!! КОГДА Я ПОПРОСИЛ ДОКАЗАТЬ ЭТО ОНИ ЗАИГНОРИЛИ И ПРУФОВ С ИХ СТОРОНЫ НЕ ПОСЛЕДОВАЛО...

VK.com: Просмотр части номера телефона и отправка на него SMS, всего раз скомпроментировав аккаунт

Статичный hash, получив который вместе с доступом к аккаунту, можно было посмотреть несколько цифр номера телефона. Статичный hash в https://vk.com/mobile - для использования не требуется входить на аккаунт жертвы...

HackerOne: Invitation token leaks to https://bat.bing.com

Summary Invitation page contains iframes that points to https://b5s.hackerone-ext-content.com/!/invitations/ and https://a4l.hackerone-ext-content.com/!/invitations/. A GET request to these endpoints executes a script that points to https://bat.bing.com/bat.js. The corresponding request to bing...

Automattic: Remote Code Execution in Wordpress Desktop

An attacker can create a malicious page that when viewed or edited in Wordpress Desktop App will results in remote code execution. This issue looks to be around this line of code: https://github.com/Automattic/wp-desktop/blob/develop/desktop/window-handlers/external-links/index.jsL38 If...

GitLab: GitLab CI runner can read and poison cache of all other projects

The GitLab CI runner allows users to cache files and directories in between runs. These files are stored in a ZIP file and uploaded to a shared cache instance. In my testing, the files were uploaded to runners-cache-4-internal.gitlab.com and runners-cache-3-internal.gitlab.com, even for dedicated...

Ubiquiti Inc.: Unrestricted File System Access via Twig Template Injection on dev-ucrm-billing-demo.ubnt.com

The researcher found a Local File inclusion vulnerability, this could be exploited by using Twig templates available on the system. This vulnerability only have the potential to affect dev-ucrm-billing-demo.ubnt.com, although is limited by the restricted environment docker with don't allow any...

Zomato: [www.zomato.com] Boolean SQLi - /███████.php

@gerbenjavado found that the parameter brids which was a JSON array was vulnerable to boolean SQL injection. POC Requesting MID0x352e362e33332d6c6f67,1,1//LIKE//5 hex == @@version resulted in a 500 HTTP status and MID0x352e362e33332d6c6f67,1,1//LIKE//4 resulted in a 200 HTTP status. Showing that...

GitLab: GitHub import allows user to create child group under existing namespace

When importing a GitHub repository on GitLab, a request is made to /import/github. The user is allowed to pass along a target namespace where they want to add the repository. In this process, the code will create the namespace if it doesn't exist already. However, this can be used to create a...

VK.com: CSRF в m.vk.com

Отсутствие проверки хеша при скрытии записей в мобильной ленте...

Mavenlink: Account members can re-add themselve after has been deleted by administrator

Reproduction: ========= - As an administrator, invite an account members e.g: [email protected] via https://app.mavenlink.com/settings/account/members - An invitation link sent to [email protected], as user1, open email inbox and click on the link, notice the link redirects to page url:...

New Relic: User to Admin privilege escalation in Infrastructure Conditions - /v2/accounts/1835740/alerts/conditions

Details The endpoints POST /v2/accounts/:accountid/alerts/conditions create new and PUT /v2/accounts/:accountid/alerts/conditions/:conditionid update existing on infrastructure-alert.service.newrelic.com are vulnerable to privilege escalation. As per the screenshot below, an account with regular...

LocalTapiola: Secure Client-Initiated Renegotiation

Renegotiation can open the door to attacks. There are two primary worries: CVE-2009-3555: This vulnerability allows a “man-in-the-middle” attacker to inject data into an HTTPS session and execute requests on behalf of the victim. Refer to CVE-2009-3555 for more details. Denial of Service DoS:...

Automattic: Stored XSS in www.learnboost.com via ZIP codes.

Summary --- www.learnboost.com is vulnerable to stored XSS via ZIP codes stored alongside school names in the Network panel. Browsers Verified In --- Mozilla Firefox 58.0b12 64-bit PoC --- Visit https://www.learnboost.com/settings/network/search and search for fro. My entry will trigger the XSS...

Uber: Hack The World 2017 Top 2 Bonus

Thanks for your participation in Hack the World 2017, @nutellite!...

Coinbase: Ethereum account balance manipulation

The researchers noticed an issue with our ETH receiving code when receiving from a contract. This allowed sending of ETH to Coinbase to be credited even if the underlying contract execution failed. The issue was fixed by changing the contract handling logic. Analysis of the issue indicated only...

VK.com: Монипулирование на страницах пользоватлей значением "Подсказывать стикеры в полях ввода"

Отсутствовал hash в запросах при изменении настроек стикеров. Ошибочка в репорте включить на конце 1 Включить https://m.vk.com/attachments?ajax=1&act=stickershintsenabled&value=1 CSRF - ОТСУСТВИЕ HASH дает возможность совершать переключение в мобильной версии ВК , подсказок в полях ввода ! Тем...

Concrete CMS: Stored XSS on Add Calendar

Greetings, There is no soup like crayons soup with vegetables. Hello @Concrete5 Team. Like my last report 300532 I found other Stored XSS vulnerability in your nice CMS. If you don't mind I will omit what Stored - XSS is and its description, hope everything is fine in your side about that :. The...

U.S. Dept Of Defense: SharePoint exposed web services

Microsoft SharePoint is a web application platform developed by Microsoft. Because of improper configuration an anonymous user has access to the SharePoint Web Services. The impact of this vulnerability The SharePoint Web Services can disclose sensitive information. This information can be used t...

U.S. Dept Of Defense: SharePoint exposed web services

Microsoft SharePoint is a web application platform developed by Microsoft. Because of improper configuration an anonymous user has access to the SharePoint Web Services. The impact of this vulnerability The SharePoint Web Services can disclose sensitive information. This information can be used t...

Concrete CMS: Stored XSS on Add Event in Calendar

Greetings In crayons we trust Hello @Concrete5 Team. While checking the Hacktivity in your HackerOne Program I saw many reports regarding to XSS thus I will omit the vulnerability description I'm going to report now. After downloaded Concrete5 8.3.1 released at 12/20/17, while searching for some...

U.S. Dept Of Defense: WebLogic Server Side Request Forgery

Universal Description Discovery and Integration UDDI application is publicly available on this WebLogic server. The SearchPublicRegistries.jsp page can be abused by unauthenticated attackers to cause the WebLogic web server to connect to an arbitrary TCP port of an arbitrary host. Responses...

Zomato: [www.zomato.com] Privilege Escalation - /php/restaurant_menus_handler.php

Introduction In the following ██████████ the endpoint /php/restaurantmenushandler.php was found. This endpoint is meant solely to be accessible for admins, however due to insufficient protections normal users can access this endpoint too. This results in any Zomato user being able to edit and...

LocalTapiola: The parameter in the POST query allows to control size of returned page which in turn can lead to the potential DOS attack

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Do not remove any subsections of this template. If the report is not complete, we will most likely close your report with no further action. QUALITY BEFORE QUANTITY. Remember, the more...

Shopify: Ability to bypass partner email confirmation to take over any store given an employee email

I told Pete I would take a look at Spotify, hi Pete. Summary It's possible to take over any store account through partners given an employee email address. This is possible because I found a way to confirm arbitrary emails. I don't know the Shopify ecosystem well enough to know the other...

Unikrn: [unikrn.com] Profile updated with error":true,"success":false"

Greetings, We noticed that even if the https://unikrn.com/apiv2/user/updateprofile gave an answer that the code is on error , the post is proceeded : PoC : -- curl 'https://unikrn.com/apiv2/user/updateprofile' -XPOST -H 'Referer: https://unikrn.com/profile' -H 'Content-Type: application/json' -H...

Automattic: Stored XSS in learnboost.com via the lesson[goals] parameter.

Summary --- learnboost.com is vulnerable to stored XSS via the lessongoals parameter. Browsers Verified In --- Mozilla Firefox 58.0b12 64-bit PoC --- The payload I used was: html Click F249206 POST /apps/lesson/update HTTP/1.1 Host: www.learnboost.com User-Agent: Mozilla/5.0 X11; Linux x8664;...

Brave Software: Torrent Viewer extension web service available on all interfaces

Summary: When files are downloaded via the Torrent Viewer, a local web service is spun up that allows the user to download the files. This web service listens on all interfaces, allowing anyone in the network to view what files are being downloaded, and download them from the user. This mostly...

Mavenlink: User uploaded portfolio files can be accessed by any user even after deleted

Reproduction: ========= 1. Login as a user, e.g: user1 2. Create a portfolio by going to https://app.mavenlink.com/users/1234567-user1/worksamples/new note: replace 1234567-user1 with the actual user id/name endpoint. 3. Uploading any file to the new portfolio and click save. On the right side of...

Zomato: [https://reviews.zomato.com] Time Based SQL Injection

@samengmg found an cookie based SQL injection on https://reviews.zomato.com. I noticed that two cookies were submitted during a request during the login page of https://reviews.zomato.com orange squeeze Due to the oddly named cookies, I decided to fuzz them. Eventually, I discovered both are...

Hiro: REDIRECTION VULNERABILITY/HOST HEADER INJECTION VULNERABILITY

Hiii.. This is vyshnav nk i need to address you a vulnerability i have found in https://github.com/blockstack/blockstack-core/ https://github.com/blockstack/blockstack-core/ is vulnerable to host header injection/redirection vulnerability.. IMPACT:- Attack vectors are somewhat limited but depends...

Razer US: SQL Injection on careers.razerzone.com within the Admin interface without any access credentials

The researcher discovered a SQL Injection vulnerability on our careers.razerzone.com host, which is used to list job openings for Razer worldwide and receive application submissions from potential hires. This vulnerability could have allowed the exfiltration of admin credentials as well as person...

LocalTapiola: Cleartext protocol after bank authentication (yrityspalvelu.tapiola.fi)

Issue The reporter found a redirect from https-http-https in the late stages of the authentication process. Fix The issue was fixed. Reasoning Although no authentication information was leaked, session related data could in theory also leak at this stage of the authentication process, hence a...