Starbucks: Unrestricted File Upload Leads to RCE on mobile.starbucks.com.sg

ko2sec discovered an .ashx endpoint on mobile.starbucks.com.sg intended for image files permitted unrestricted file type uploads which could lead to a potential RCE. ko2sec's thorough analysis provided additional endpoints on other out of scope domains that shared this vulnerability. @ko2sec —...

Mail.ru: Clickjacking Vulnerability via https://www.donationalerts.com/help/support leads to bypass for widget.support.my.games X-Frame Options

Clickjacking protection bypass on widget.support.my.games via donationalerts.com...

Mail.ru: Disk-o Cloud application (Windows) does not validate server certificate on a TLS connection

A debugging/staging functionality disabling TLS certificate check was accidentally enabled in production code for Disk-O 20.10.0133, fixed in version 20.11.0006. 21.04 version adds integrity check for update process...

BugPoC: [BugPOC and Amazon XSS CTF writeup] A CSP Bypass Story

Summary/Description: There were quite multiple restrictions imposed while executing JavaScript on the website. I have divided them into three segments which are explained below Bypassing the iframe loading restriction The URL https://wacky.buggywebsite.com/frame.html?param=Hello,%20World when...

BugPoC: csp bypass leads to xss on wacky.buggywebsite.com

Summary: report will be uploaded later - need some sleeps █████████ ███ Steps To Reproduce: PoC above Thanks for the challenge. I tried to use bugpoc for everything but ended up using aws to host the js file - seemed fitting as well and served the purpose. F1065889 Impact taking over all the whac...

BugPoC: Solution to the XSS Challenge

Summary: This challenge is very tricky and advanced. I have reached a part where I can execute my JS code, but that payload is blocked as of now by "allow-modals" missing value in the "sandbox" attribute. Following is a better explanation of where I am right now. Steps To Reproduce: 1. Keep the...

BugPoC: XSS :D

Great summary found here https://medium.com/bugbountywriteup/wacky-xss-challenge-with-amazon-by-bugpoc-d10d43d7707c This is the accepted solution of wacky xss ctf by bugpoc that amazon sponsored. Here is the write up for the same...

U.S. Dept Of Defense: Unauthenticated Arbitrary File Deletion "CVE-2020-3187" in █████

Summary: A vulnerability in the interface of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and obtain read and delete access to sensitive files. Description:...

GitHub Security Lab: [Java] CWE-927: Sensitive broadcast

This bug was reported directly to GitHub Security Lab...

Basecamp: Information Disclosure of Garbage Collection Cycle 'Again'

A diagnostic subdomain was still available publicly after being reported https://hackerone.com/reports/981796 and remediation. Subsequently a researcher was able to access the subdomain. Disclosure has been limited as the report contains low sensitive information, but sensitive none the less...

U.S. Dept Of Defense: Unauthorized access to admin panel of the Questionmark Perception system at https://██████████

Summary: Due to the lack of access control, an anonymous attacker can compromise the administrator account on the Questionmark Perception system. Description: By using the service description which publicly accessible on the internet, and by bypassing the access control, an anonymous attacker can...

Lark Technologies: Accessing/Editing Folders of Other Users in the Orginisation.

A vulnerability was found where users without Primary admin privileges were able to view/modify the directory structure of other users in their organization. This would occur after those users were invited to view/modify their folders by a Primary admin. We thank @snapsec for reporting this to ou...

Node.js third-party modules: Default behavior of Fastifys versioned routes can be used for cache poisoning when Fastify is used in combination with a http cache / CDN

I would like to report possible cache poisoning in Fastify It allows an attacker to perform an cache poisoning when Fastify is used in combination with a http cache / CDN. Module module name: Fastify version: 3.x npm page: https://www.npmjs.com/package/fastify Module Description Fast and low...

Stripo Inc: Stored XSS at Template Editor in "Section Name" Field of Block element 'Accordion'.

Summary: Hi Team, There is "Stored XSS" in Template Editor. When creating Accordion, "Section Name" field does not properly sanitize the input provided by the User leading to Stored XSS. See the Proof Of Concept below. Thank You. Steps To Reproduce: A. Open Template Editor and insert element...

U.S. Dept Of Defense: Apparent ██████████ website is publicly exposed, suggests default account details on page and has expired SSL/TLS cert

Summary: Publicly exposed website ███████ offering default login user/pass with expired SSL Description: https://██████/ is branded as '████' with ██████ branding/logo and links to ██████ homepage, defense.gov & @DeptofDefense Twitter account Impact Publicly exposed service with potentially defau...

VK.com: XSS in vk.link

XSS на vk.link...

U.S. Dept Of Defense: [SQLI ]Time Bassed Injection at ██████████ via /██████/library.php?c=G14 parameter

Step-by-step Reproduction Instructions copy the request to your burp suite : GET /█████████/library.php?c=G14'XORifnow=sysdate,sleep11,0OR' HTTP/1.1 Host: ██████ Accept-Encoding: gzip, deflate Accept: / Accept-Language: en User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36...

Mail.ru: file read on MCS servers via supplying a QCOW2 image with external backing file

Local file read in mcs.mail.ru by providing QCOW2 disk image with backing image pointing to external file Mail.ru Cloud Solutions allows uploading custom images for disks. This functionality supported QCOW2 disk images. A QCOW2 disk image can have a so-called "backing image" - a file to read...

Basecamp: SSL expired subdomain leads to API swap with main and flagged cookies. Unable to log device ids and certain session tokens.

SUMMARY - Replacing the login page of launchpad.37signals.com with subdomain help-basecamphq.37signals.com greats you to a login page in which is unsecure and with header sec-fetch-site: same-origin injected into your headers you can disable cookies such as . STEPS TO REPRODUCE 1. Visit...

Mail.ru: SQL injection delivery-club.ru (ClickHouse)

Some requests to clickhouse in delivery-club.ru were externally available potentially allowing SQL-like requests execution...

curl: Cookie exposure due to unexpected file permission change

Summary: libcurl since 7.72.0 changes file specified in CURLOPTCOOKIEJAR to group and world readable, regardless of prior file permissions of an already existing file assuming typical default umask of 022. This is unexpected as typically file permissions of an already existing file are not change...

Internet Bug Bounty: DOMPurify bypass

A mutation based bypass exists in DOMPurify when sanitizing svg elements using almost the same technique described by Michał Bentkowski @SecurityMB at https://research.securitum.com/mutation-xss-via-mathml-mutation-dompurify-2-0-17-bypass/. A PoC payload with the DOM state before and after parsin...

Brave Software: Brave Browser potentially logs the last time a Tor window was used

Summary: A vulnerability in the Brave Browser allows an attacker to view the last time a Tor session was used in incognito mode. A local, on-disk attacker could read the Brave Browser's "Local State" json file and identify the last time a Tor session was used, affecting the confidentiality of a...

TikTok: RCE on TikTok Ads Portal

The video upload endpoint on the TikTok Ads portal was potentially susceptible to remote code execution RCE due to a ffmpeg misconfiguration. We thank @ bubbounty for reporting this to our team and confirming the resolution. During my research on the TikTok Ads portal I found a RCE thought the...

Mail.ru: [files.ucs.ru] ProFTPd mod_copy Arbitrary Read/Write

CVE-2015-3306 in opened to external network FTP server on files.ucs.ru...

Mail.ru: [api-site.city-mobil.ru] Improper access control leads to information disclosure (bypass of #977597 fix)

Authorization for api-site.city-mobil.ru endpoint was not properly checked, allowing to obtain data about arbitrary corporate.city-mobil.ru orders and users. Find a way to bypass a bad fix for 977597. There are more steps in the new scenario that allows exploiting the issue. An attacker needs to...

Mail.ru: SDC bypass on calendar.mail.ru

SDCS cookie was not properly checked for few calendar.mail.ru endpoints, allowing to bypass SDC secure domain cookies protection for privilege separation between projects...

Mail.ru: Account Takeover on [ls5-dev.ucs.ru]

Login functionality on ls5-dev.ucs.ru was not sufficiently protected against bruteforce...

Stripo Inc: SSRF external interaction

hi team, i found ssrf external interaction on your website which is https://my.stripo.email/cabinet//login?guid=&tn=&locale=en on chatbox description:- the attacker might cause the server to make connection back to it self or to other web services within the organization infrastructure or to...

Ruby on Rails: Regular expression denial of service in ActiveRecord's PostgreSQL Money type

Summary Hello team! The regular expressions used in the Money type to convert strings like -$100,000.00 to 100000 have an execution time with a quadratic growth proportional to the length of the string. Causing the denial of service requires very long strings but if the parameter is in a post bod...

Mail.ru: CVE-2020-3187 на ip адресе 91.231.115.30

CVE-2020-3452 on webvpn.city-srv.ru...

Nextcloud: Stored XSS in markdown file with Nextcloud Talk using Internet Explorer

While editing a markdown file through the text app, users can create link elements that have a javascript URL such as javascript:alert1. Steps to reproduce: While editing a markdown file, select some text and click the "Add Link" button. Using a web proxy, intercept the request and change the hre...

Yelp: password field autocomplete enabled

Summary: Most browsers have a facility to remember user credentials that are entered into HTML forms. This function can be configured by the user and also by applications that employ user credentials. If the function is enabled, then credentials entered by the user are stored on their local...

Shopify: Staff with no permissions can listen to Shopify Ping conversations by registering to its different WebSocket Events

By registering to a few different Shopify Ping Websocket Events on the wss://argus.shopifycloud.com/graphql?shopid=id endpoint, a staff without any permission can listen to conversions with customers. Steps to reproduce 1. With a staff that doesn't have any permissions, login into the shop admin ...

Mail.ru: Improper Restriction of Excessive Authentication Attempts via https://certification.mail.ru/auth-form/?form=auth_certy (Rate limit Bypass)

Login functionality on certification.mail.ru was not sufficiently protected against bruteforce...

Acronis: [acronis.secure.force.com] - Insecure Salesforce default/custom object permissions leads to information disclosure

Hi there, I know that this domain https://acronis.secure.force.com is not listed in scope but I thought it would be a good idea to share this finding with you because this endpoint is leaking internal information/meetings. Target: The Salesforce instance at https://acronis.secure.force.com...

BugPoC: Strict Transport Security Misconfiguration

Hello I have found security vulnerable The vulnerable URL: https://bugpoc.com/icons/bandage.svg Summary The table below shows the numbers of issues identified in different categories. Issues are classified according to severity as High, Medium, Low or Information. This reflects the likely impact ...

Mail.ru: Exposed Credentials May Leads to Tarantool Infrastructure Leak

Application configuration data related to Tarantool project was leaked on github.com...

TikTok: HTML Injection on Company Name on Email

By changing the company name to any HTML code on the TikTok Creator Marketplace, an attacker could potentially use this to send phishing emails to users containing injected HTML payload. We thank @gnux for reporting this to our team and confirming the resolution!...

Showmax: WordPress admin is accessible without HTTP authentication

The wordpress instance stories.showmax.com is a complementary system of the Showmax platform. We enforce 2FA for all user accounts that have access to the administration and that's why we decided not to require Basic Auth and/or IP whitelisting for it...

Nextcloud: Leaked of Profile Image from URL changing

Chaning the email address of url will show other's profile images. Impact Leakage of Users Profile Pictures if known email...

Semrush: Critically Sensitive Spring Boot Endpoints Exposed

Spring Boot includes a number of additional features to help you monitor and manage your application when you push it to production. Hacker found that actuator endpoints containing potentially sensitive data such as internal tokens and service data were left public. Semrush has a microservices...

Shopify: [Information Disclosure] Amazon S3 Bucket of Shopify Ping (iOS) have public access of other users image

Hello Shopify, when testing Shopify Ping share image function, I discovered an Amazon S3 bucket which has public access which allows an attacker to view all the image of other merchant & users. Steps To Reproduce: 1. Install Shopify Ping on your phone then enable Shopify Chat for your store. 2. G...

Basecamp: Bypass of image rewriting / tracking blocker via srcset

CVSS ---- Medium 4.7 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N Description ----------- One of the security features of Hey is blocking of tracking pixels to preserve users privacy. As such, img tags and similar are rewritten by the app to point to gopher.hey.com. However, an attacker can bypas...

CS Money: Attacker can generate cancelled transctions in a user's transaction history using only Steam ID

Summary: The API endpoint /create-payment requires only the steam ID of the account to create the payment. When this endpoint is called using the cardpay flow, it returns a transaction ID on the Cardpay system. The attacker can access this transaction, and immediately cancel it or pay it ; , whic...

Lark Technologies: Privilege Escalation to All-staff group

A vulnerability was found where invited admins with only Company Info permissions were able to modify Staff group settings, including edit / access / delete all-staff, within the members and orgs tab. We thank @snapsec for reporting this to our team...

New Relic: Account takeover by using abandoned email id of victim which has already been changed to new by victim himself on one.newrelic.com

@ashmek identified an inconsistency with account mapping between New Relic One and the discussion forum. This resulted in a situation where a user who has changed their email address could have contents of their account displayed to a new user who had access to the original email address...

Mail.ru: "blog.skillfactory.ru" Vulnerable to Directory Traversal

CVE-2020-11738 on blog.skillfactory.ru...

Mail.ru: Improper Restriction of Excessive Authentication Attempts at https://top.mail.ru/edit? for site counter (Rate Limit bypass via IP Rotation)

Password at top.mail.ru counters was not sufficiently protected against bruteforce...

U.S. Dept Of Defense: System Error Reveals Sensitive SQL Call Data

Summary: If you attempt to login at https://███.mil/sso/LoginRequest.do using a very long username, the application will respond showing a stack trace information with sensitive SQL data call information. This reveals too much information about SQL calls to the database. Please see the attached P...