Browse / Bypasses / Path and encoding checks

Getting past path and encoding checks

Path normalisation, traversal filters and encoding tricks. 50 disclosed reports got past one.

1. RCE and Complete Server Takeover of http://www.█████.starbucks.com.sg/Code Injection · critical · Starbucks
   572 votes
2. CSRF protection bypass in GitHub Enterprise management consoleCross-Site Request Forgery (CSRF) · high · GitHub
   $10,000152 votes
3. One Click Account takeover using Ouath CSRF bypass by adding Null byte %00 in state parameter on www.streamlabs.comCross-Site Request Forgery (CSRF) · medium · Logitech
   99 votes
4. [h1-415 2020] Spent a week and failed at solving the last step.Improper Access Control - Generic · critical · h1-ctf
   99 votes
5. Bypass rate limiting on /users/password (possibly site-wide rate limit bypass?)Violation of Secure Design Principles · HackerOne
   76 votes
6. Bypass of Open Redirect Fix on lovable.dev via /..// Path Traversal in redirect parameterOpen Redirect · medium · Lovable VDP
   74 votes
7. Reflected cross-site scripting on multiple Starbucks assets.Cross-site Scripting (XSS) - Reflected · low · Starbucks
   72 votes
8. Path traversal by monkey-patching Buffer internalsPath Traversal · high · Internet Bug Bounty
   $2,43067 votes
9. Unauthenticated Path Traversal and Command Injection in Trellix Enterprise Security Manager 11.6.10OS Command Injection · critical · Trellix
   60 votes
10. WAF bypass via double encoded non standard ASCII chars permitted a reflected XSS on response page not found pages - (629745 bypass)Cross-site Scripting (XSS) - Reflected · low · Starbucks
    58 votes
11. Invalid Host detection at https://hackerone.com/redirectViolation of Secure Design Principles · low · HackerOne
    57 votes
12. Link filter protection bypassOpen Redirect · medium · Valve
    55 votes
13. Cisco IOS XE instance at ████ vulnerable to CVE-██████Command Injection - Generic · critical · MTN Group
    48 votes
14. Path traversal leading to limited CSRF on GET requests on two endpointsCross-Site Request Forgery (CSRF) · HackerOne
    41 votes
15. Path traversal via archive.extract - CVE 2021-3281 incomplete patchPath Traversal · low · Django
    38 votes
16. Windows Device Names (CON, PRN, AUX) Bypass Path Traversal Protection in path.normalize()Path Traversal · high · Node.js
    35 votes
17. GET based Open redirect on [streamlabs.com/content-hub/streamlabs-obs/search?query=]Open Redirect · low · Logitech
    $10034 votes
18. Cache poisoning using NULL bytes and long URLsImproper Null Termination · medium · Greenhouse.io
    32 votes
19. /applications/dpc_(get|post) provide full access to api.steampowered.com with the Dota2 API keyServer-Side Request Forgery (SSRF) · high · Valve
    30 votes
20. Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773) (CVE-2021-42013)Path Traversal · critical · Internet Bug Bounty
    $1,00029 votes
21. Improper Access Control on Onelogin in multi-layered architectureImproper Access Control - Generic · Uber
    $50029 votes
22. Bypass of request line length limit to DoS via cache poisoningUncontrolled Resource Consumption · medium · Greenhouse.io
    24 votes
23. Reflected XSS via Double EncodingCross-site Scripting (XSS) - Reflected · medium · Rockstar Games
    $50022 votes
24. Path Traversal in writeFile via Unsafe Prefix Containment Check Allows Out-of-Directory WritesPath Traversal · medium · arkadiyt-projects
    21 votes
25. Multiple permission model bypasses due to improper path traversal sequence sanitizationPath Traversal · high · Node.js
    20 votes
26. Bypass of #1047119: Missing Rate Limit while creating Plug-Ins at https://my.stripo.email/cabinet/plugins/Business Logic Errors · medium · Stripo Inc
    19 votes
27. Path Traversal Bypass in file:// URLs Due to Incomplete URL-Encoded Path NormalizationPath Traversal · high · curl
    18 votes
28. [h1-415 2020] H1-415 CTF Writeup by W--Security Through Obscurity · critical · h1-ctf
    17 votes
29. libcurl FTP path normalization flaw allows decoded %2e%2e → CWD .. and directory escape (Path Traversal, CWE-22)Path Traversal · high · curl
    16 votes
30. [h1-415 2020] My writeup on how to retrieve the special secret documentImproper Authentication - Generic · critical · h1-ctf
    16 votes
31. [Total.js] Path traversal vulnerability allows to read files outside public directoryPath Traversal · medium · Node.js third-party modules
    16 votes
32. [serve] Directory listing and File access even when they have been set to be ignored.Information Exposure Through Directory Listing · critical · Node.js third-party modules
    15 votes
33. Multiple File Manipulation bugs in WP Super Cache Automattic
    15 votes
34. Missing FILE-privilege enforcement in CONNECT file UDFs allows server-side file read and writeImproper Access Control - Generic · high · MariaDB
    14 votes
35. Improper deep link validation Forced Browsing · low · Shopify
    14 votes
36. Denial of Service (DoS) vulnerability in dedotdotify() URL path normalizationUncontrolled Resource Consumption · high · curl
    13 votes
37. Fix for CVE-2021-22151 (Kibana path traversal issue) can be bypassed on WindowsPath Traversal · low · Elastic
    10 votes
38. HSTS multi-trailing-dot bypass-ish: possible incomplete fix for CVE-2022-30115Cleartext Transmission of Sensitive Information · medium · curl
    9 votes
39. Directory traversal attack in view resolverInformation Disclosure · Ruby on Rails
    8 votes
40. Broken Authentication (including Slack OAuth bugs)Violation of Secure Design Principles · Slack
    8 votes
41. inconsistently Rejection Logic in file:// URLs with AuthorityPath Traversal · low · curl
    7 votes
42. https://█████████ Vulnerable to CVE-2018-0296 Cisco ASA Path Traversal Authentication BypassPath Traversal · high · U.S. Dept Of Defense
    6 votes
43. Filesystem experimental permissions policy does not handle path traversal cases.Path Traversal · high · Node.js
    5 votes
44. `superstatic` is vulnerable to path traversal on WindowsPath Traversal · high · Node.js third-party modules
    5 votes
45. Self-XSS can be achieved in the editor link using filter bypassCross-site Scripting (XSS) - Generic · Weblate
    5 votes
46. More content spoofing through dir param in the files appViolation of Secure Design Principles · low · Nextcloud
    $505 votes
47. [harp] File access even when they have been set to be ignored.Information Exposure Through Directory Listing · medium · Node.js third-party modules
    4 votes
48. Bypass to defective fix of Path Traversal Path Traversal · high · Node.js third-party modules
    4 votes
49. CVE-2023-27534: SFTP path ~ resolving discrepancyPath Traversal · low · curl
    3 votes
50. Grinch Networks compromised!critical · h1-ctf
    3 votes