+- Dark C0d3rs (https://darkcoders.wiki)
+-- Forum: Exploit Log (https://darkcoders.wiki/Forum-Exploit-Log)
+--- Forum: Research Papers/Vulnerability reports (https://darkcoders.wiki/Forum-Research-Papers-Vulnerability-reports)
+--- Thread: HackerOne Disclosed Reports - 2025-03-27 (/Thread-HackerOne-Disclosed-Reports-2025-03-27)
HackerOne disclosed reports - 2025-03-27 - hashXploiter - 03-28-2025
resolved
Cloudflare WAF Bypass - Origin IP Exposure
Bug reported by aarav was disclosed at March 27, 2025, 5:08 pm |
The Cloudflare WAF was bypassed, exposing an IP address belonging to a server operated by Hemi.
resolved
HTTP Response Header Injection in shopify/pitchfork + Rack 3
Bug reported by ooooooo_q was disclosed at March 27, 2025, 2:37 pm | HTTP Response Splitting
The HTTP response header injection vulnerability was discovered in the Pitchfork library version 0.10.0 when used with Rack 3. The issue stemmed from improper handling of header values containing newline characters in the `append_header` method of the HTTP response module. When Rack 3 was used, the newline characters were not properly sanitized and were displayed as-is in the output, enabling header injection. This vulnerability could have potentially led to further attacks, such as cross-site scripting (XSS).