Download - Discourse SNS RCE, a Stored XSS in GitLab, and a Reddit Race Condition [Bug Hunting]

Discover

Podcast Features
Your all-in-one podcasting solution.

Blog to Podcast
Turn your blog into an engaging podcast.
Livestream
High-performing audio live, without limits.

Podcast Studio
Easy-to-use audio recorder app.
Podbean AI
AI-Enhanced Audio Quality and Content Generation.

Podcast App
The best podcast player & podcast app.

Ads Marketplace
Join Ads Marketplace to earn money
through sponsorship on your podcast.

PodAds
Manage your ads with dynamic ad insertion capability.
Apple Podcasts Subscriptions Integration
Effortlessly publish and manage exclusive episodes for your
Apple Podcasts subscribers directly from Podbean.
Live Streaming
Receive livestream rewards from your audience and earn
recurring income from your Fan Club membership.

All Arts Business Comedy Education
Fiction Government Health & Fitness History Kids & Family
Leisure Music News Religion & Spirituality Science
Society & Culture Sports Technology True Crime TV & Film
Live

How to Start a Podcast
How to Start a Live Podcast
How to Monetize a podcast
How to Promote Your Podcast
How to Use Group Recording

Log in
Start your podcast for free

Podcasting
Monetization
Advertisers
Enterprise
Pricing
Discover

Day[0]

Technology

Discourse SNS RCE, a Stored XSS in GitLab, and a Reddit Race Condition [Bug Hunting]

2021-11-02

Download Right click and do "save link as"

Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/discourse-sns-rce-a-stored-xss-in-gitlab-and-a-reddit-race-condition.html

A couple unique vulns this week involving getting extra coins on Reddit, and bypassing certificate checking for a Discourse RCE.

[00:00:40] Agent 007: Pre-Auth Takeover of Build Pipelines in GoCD

[00:09:50] Race condition leads to Inflation of coins when bought via Google Play Store

[00:15:11] [GitLab] Stored XSS in Mermaid when viewing Markdown files

[00:33:28] Discourse SNS webhook RCE

[00:47:28] [GitLab] Stored XSS in Mermaid when viewing Markdown files

The DAY[0] Podcast episodes are streamed live on Twitch (@dayzerosec) twice a week:

Mondays at 3:00pm Eastern (Boston) we focus on web and more bug bounty style vulnerabilities
Tuesdays at 7:00pm Eastern (Boston) we focus on lower-level vulnerabilities and exploits.

The Video archive can be found on our Youtube channel: https://www.youtube.com/c/dayzerosec

You can also join our discord: https://discord.gg/daTxTK9

Or follow us on Twitter (@dayzerosec) to know when new releases are coming.