Wednesday, February 19, 2020

Data Tampering Issue in Spot.im Application (Write Up)



Howdy!


Early in November last year I found a vulnerability on a comment plugin of Spot.IM which affects their customers that uses their service. The vulnerability allows attacker to tamper data of the comment that can end up into impersonating other users. It can allow attacker to change the Text, Display Name and the Star ratings for the comment. The vulnerability was reported to Spot.IM and was rejected as for their reason it was related to phishing.

--Proof of Concept--






--Report Timeline--

Reported: Tue, Nov 26, 2019, 6:16 PM
Closed (Final Response): Fri, Dec 6, 2019, 3:21 AM

Hi Evan,
You are only modifying your own account data and it does not interfere with the data of others.
You will be unable to set a username if the username is already taken. You will be able to modify your display name, however display names are different from usernames.
Currently there are no privacy or authentication issues caused by this.
Kind Regards,
Spot.IM  

I hope you enjoy this write up! stay tune for more contents like this in the future.

Have a great day,

Evan

"Push yourself, because no one else is going to do it for you."

Thursday, February 06, 2020

Popping Alerts in Mixmax Chrome Extension (Write Up)





Howdy!


Back in 2017, I reported this simple XSS vulnerability that affects Mixmax Chrome Extension. The vulnerability was due to a feature called insert link/URL. This vulnerability didn't trigger on other user since the payload was filtered after it was push to the victim so ends up into self-XSS but Mixmax issued a fix and rewarded me a Mixmax swag that until now didn't arrive. (I don't know why). This vulnerability was reported to Mixmax via Hackerone.


--Proof of Concept--



PS: Don't mind my inbox, nothing sensitive in there.

--Report Timeline--

Report Title: XSS in Mixmax Chrome Extension
Reported: 2017-10-31 13:00:48 +0000
Triaged: 2018-01-08 19:45:25 +0000
We'll fix, thanks!
Fixed: 2018-02-10 03:50:44 +0000
Reward: Mixmax Swag

I hope you enjoy this write up! stay tune for more contents like this in the future.

Have a great day,
Evan

“To be yourself in a world that is constantly trying to make you something else is the greatest accomplishment.”
― Ralph Waldo Emerson