/Hive Five #37 · Sep 27, 2021
Make it rain
/The Bee's Knees 🐝
The headline picks from this issue. The full issue has more.
-
$50,000 Shopify access to source code via leaking GitHub token - Hackerone bug bounty
This video is an explanation of $50,000 vulnerability in Shopify bug bounty program that allowed push and pull access to all Shopify repositories on GitHub. It was achieved by leaking GitHub API Personal Access Token by one of Shopify employees. The bug was reported on Hackerone by Augusto Zanellato
Watch : $50,000 Shopify access to source code via leaking GitHub token - Hackerone bug bounty -
FAV/E - Find A Vulnerability/Exposure
To be a successful bug bounty hunter, you must be on a continuous search for new vulnerabilities and exploits. Aside from staying glued to infosec Twitter feeds, one of the best ways of introducing yourself to new vulnerabilities and exploitation methods is to stay up to date with the latest CVEs.
Read : FAV/E - Find A Vulnerability/Exposure -
5 RCEs in npm for $15,000
In this post, they will discuss the root cause of these vulnerabilities, as well as briefly walk through the exploitation process. They’ll also include some thoughts about bug bounty in general at the end. CVE-2021-39134 affects @npmcli/arborist. The others affect node-tar.
Read : 5 RCEs in npm for $15,000 -
Disclosure of three 0-day iOS vulnerabilities and critique of Apple Security Bounty program
Sharing their frustrating experience participating in Apple Security Bounty program.
Read : Disclosure of three 0-day iOS vulnerabilities and critique of Apple Security Bounty program -
Apache Dubbo: All roads lead to RCE
During an audit of Apache Dubbo v2.7.8 source code, Alvaro found multiple vulnerabilities enabling attackers to compromise and run arbitrary system commands on both Dubbo consumers and providers.
Read : Apache Dubbo: All roads lead to RCE