{"action":"closed","issue":{"url":"https://api.github.com/repos/Tarsnap/tarsnap/issues/189","repository_url":"https://api.github.com/repos/Tarsnap/tarsnap","labels_url":"https://api.github.com/repos/Tarsnap/tarsnap/issues/189/labels{/name}","comments_url":"https://api.github.com/repos/Tarsnap/tarsnap/issues/189/comments","events_url":"https://api.github.com/repos/Tarsnap/tarsnap/issues/189/events","html_url":"https://github.com/Tarsnap/tarsnap/issues/189","id":172253962,"number":189,"title":"Vulnerability@TarSnap","user":{"login":"zerocoolghostman","id":16766772,"avatar_url":"https://avatars.githubusercontent.com/u/16766772?v=3","gravatar_id":"","url":"https://api.github.com/users/zerocoolghostman","html_url":"https://github.com/zerocoolghostman","followers_url":"https://api.github.com/users/zerocoolghostman/followers","following_url":"https://api.github.com/users/zerocoolghostman/following{/other_user}","gists_url":"https://api.github.com/users/zerocoolghostman/gists{/gist_id}","starred_url":"https://api.github.com/users/zerocoolghostman/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zerocoolghostman/subscriptions","organizations_url":"https://api.github.com/users/zerocoolghostman/orgs","repos_url":"https://api.github.com/users/zerocoolghostman/repos","events_url":"https://api.github.com/users/zerocoolghostman/events{/privacy}","received_events_url":"https://api.github.com/users/zerocoolghostman/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-08-20T05:09:39Z","updated_at":"2016-08-20T09:37:24Z","closed_at":"2016-08-20T09:37:24Z","body":"**i reported this to admin 8 days ago but no reply**\r\nemail address: hackridersec@gmail.com\r\n------------------------------------------------\r\nHello TarSnap Security Team\r\n---------------------------\r\nMy name Is Shivbihari Pandey\r\n------------------------------\r\nBug: \r\n1.Poor Password Policy\r\n2.Authentication Problem\r\n3. Poor Encryption in the Web Browser\r\n\r\n----------------------------------------------\r\nPOC Video Attached \r\nLink Here: \r\n\r\nhttps://drive.google.com/file/d/0B8AftaXwHcwdZkRUa1d6OUhYbWs/view?usp=sharing\r\n-------------------------------------\r\n1.Poor Password Policy\r\nSteps:\r\n\r\n1. create an account\r\n\r\n2. goto email and verify the account and set the password as \" \"(space)\r\n\r\n3.now come to login section..now login with  space as password\r\n\r\nBoom you just logged In to account\r\n\r\nactually if user choose this type of password then attacker can easily bruteforce it..and get the whole account\r\n\r\n-------------------------------------------------------------\r\n2.Authentication Problem\r\n\r\nsteps:\r\n\r\n1.Login to 2 Browser With Same Account\r\n2.Now from one Browser Just Change the password\r\n3. Come to another account and just refresh the page ..you will see the \r\naccount still remain logged in\r\n\r\ni test it ..token not expire even the password changed..\r\n\r\nif someone get hacked or he left his account in the other PC\r\nthen even he change the password..but the account remain logged in to attacker PC\r\n\r\nhope you get my point :P \r\n\r\n------------------------------------------------------------------\r\n3. Poor Encryption in the Web Browser\r\n\r\nhttps://www.tarsnap.com/manage.cgi?address=[User Email]&token=b1e6b876a00e152ec52407e00a365d507cf004d0a2f25268272a95a6b9add237&action=payment\r\n\r\nin the logged in account the account token and email not encrypted\r\n\r\n------------------------------------------------------------------------------------------------------------------\r\n\r\nRegard\r\n\r\nShivBihari Pandey\r\n\r\n(Independent Security Researcher)"}}
{"actor":{"display_login":"cperciva"}}