HackerOne Disclosed Reports - 2025-03-27

Medium
resolved

Cloudflare WAF Bypass - Origin IP Exposure

Bug reported by aarav was disclosed at March 27, 2025, 5:08 pm   |  

The Cloudflare WAF was bypassed, exposing an IP address belonging to a server operated by Hemi.

Low
resolved

HTTP Response Header Injection in shopify/pitchfork + Rack 3

Bug reported by ooooooo_q was disclosed at March 27, 2025, 2:37 pm   |   HTTP Response Splitting

The HTTP response header injection vulnerability was discovered in the Pitchfork library version 0.10.0 when used with Rack 3. The issue stemmed from improper handling of header values containing newline characters in the `append_header` method of the HTTP response module. When Rack 3 was used, the newline characters were not properly sanitized and were displayed as-is in the output, enabling header injection. This vulnerability could have potentially led to further attacks, such as cross-site scripting (XSS).