huntr.dev
Open in
urlscan Pro
2600:9000:214f:d000:14:bb32:5f00:93a1
Public Scan
URL:
https://huntr.dev/bounties/58eae29e-3619-449d-9bba-fdcbabcba5fe/
Submission: On September 21 via api from US — Scanned from DE
Submission: On September 21 via api from US — Scanned from DE
Form analysis 0 forms found in the DOM
Text Content
huntr Open menu / Bounties Community More Responsible disclosure policy FAQ Contact us Hacktivity Leaderboard Submit report Login Logout huntr Close menu / -------------------------------------------------------------------------------- Bounties Find your next target Submission Submit a report Hacktivity Browse public reports Leaderboard Our leaderboard -------------------------------------------------------------------------------- Policy FAQ Contact us Login PASSWORD CAN BE SET EXTREMELY WEAK IN IKUS060/RDIFFWEB 0 Valid Reported on Sep 9th 2022 -------------------------------------------------------------------------------- DESCRIPTION In this scenario, I use the demo website. It allows us to add more user to test. With password, we can set it 1 (Or any charater). There is no policy for password or no password checking. Moreover, it also allows us to change password and the new password also can be set with password. PROOF OF CONCEPT Access to the demo website and login as an admin. Add user with password 1 or any charater (short, weak) Try to login with the new user and it succeed. With normal user, login and try to change password function, it also succeed. IMPACT Be able to get all user's accounts with weak password by bruteforce attack. We are processing your report and will contact the ikus060/rdiffweb team within 24 hours. 13 days ago Chuu modified the report 12 days ago Chuu modified the report 12 days ago Patrik Dufresne validated this vulnerability 12 days ago Chuu has been awarded the disclosure bounty The fix bounty is now up for grabs The researcher's credibility has increased: +7 Chuu commented 12 days ago Researcher -------------------------------------------------------------------------------- thank you Patrik Dufresne commented 9 days ago Maintainer -------------------------------------------------------------------------------- @chuu The affected version is wrong It should be 2.4.1 Patrik Dufresne commented 9 days ago Maintainer -------------------------------------------------------------------------------- @admin Is it possible to get a CVE ID ? Jamie Slome commented 9 days ago Admin -------------------------------------------------------------------------------- Updated affected version and sorted a CVE for this report :) We have sent a fix follow up to the ikus060/rdiffweb team. We will try again in 7 days. 9 days ago Patrik Dufresne confirmed that a fix has been merged on 233bef 9 days ago Patrik Dufresne has been awarded the fix bounty Sign in to join this conversation CVE ID CVE-2022-3179 (assigned) Vulnerability Type CWE-521: Weak Password Requirements Severity High (7.1) Registry Other Affected Version 2.4.1 Visibility Public Status Fixed Found by Chuu @uonghoangminhchau amateur Fixed by Patrik Dufresne @ikus060 unranked This report was seen 63 times. We are processing your report and will contact the ikus060/rdiffweb team within 24 hours. 13 days ago Chuu modified the report 12 days ago Chuu modified the report 12 days ago Patrik Dufresne validated this vulnerability 12 days ago Chuu has been awarded the disclosure bounty The fix bounty is now up for grabs The researcher's credibility has increased: +7 Chuu commented 12 days ago Researcher -------------------------------------------------------------------------------- thank you Patrik Dufresne commented 9 days ago Maintainer -------------------------------------------------------------------------------- @chuu The affected version is wrong It should be 2.4.1 Patrik Dufresne commented 9 days ago Maintainer -------------------------------------------------------------------------------- @admin Is it possible to get a CVE ID ? Jamie Slome commented 9 days ago Admin -------------------------------------------------------------------------------- Updated affected version and sorted a CVE for this report :) We have sent a fix follow up to the ikus060/rdiffweb team. We will try again in 7 days. 9 days ago Patrik Dufresne confirmed that a fix has been merged on 233bef 9 days ago Patrik Dufresne has been awarded the fix bounty Sign in to join this conversation 2022 © 418sec HUNTR * home * hacktivity * leaderboard * FAQ * contact us * terms * privacy policy PART OF 418SEC * company * about * team Chat with us