HexBrain

Gratipay · Report #138659

don't expose path of Python

Informativestatus
1upvotes
13 May 2016disclosed

How it was found

Hello Team, While testing the web application I've found that if you enter the 3 or more strings including % then web application is exposing the path of Python in error.Application exposing path of Python in error when you enter the 3 or more strings including % .. if you only enter the 2 strings it will show you the 404 not found page

POC :

https://gratipay.com/%ff/ [3 strings]
Request is undecodable.(/app/.heroku/python/lib/python2.7/encodings/utf_8.py:16)

https://gratipay.com/%f/ [ 2 strings] - 404 Not Found

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original