You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@superset.apache.org by Ivan <iv...@gmail.com> on 2024/01/09 10:48:44 UTC
Vulnerability Detected, Remediation Required
Greetings,
As a bug bounty hunter and web security researcher, my main objective is to
protect the internet from cyberattacks. I specialize in identifying and
reporting bugs on websites, providing comprehensive vulnerability
assessment reports that detail the identified issues. During my recent
research efforts, I came across your website, ‘superset.apache.org’.
Vulnerability: Missing DMARC Record
DMARC is an email authentication protocol designed to help domain owners
protect their domains from unauthorized use, specifically email spoofing.
Its implementation aims to defend against business email compromise
attacks, phishing emails, email scams, and other cyber threats. A DMARC
Record includes a policy that determines how unauthenticated or forged
emails should be handled. The absence of this record creates an opportunity
for attackers to exploit the domain name. On your website, I discovered a
similar issue where anyone can send emails from Your Email:
dev@superset.apache.org to other users.
By using the following DMARC record, I successfully sent a manipulated
email to my own address, making it appear as if it originated from Contact
Form: dev@superset.apache.org
Screenshot Proof-of-Concept
[image: image.png]
[image: image.png]
Impact:
This phishing technique can be highly effective, allowing attackers to send
forged emails from your domain and impersonate your company's official
representatives. They can manipulate victims into providing sensitive
information, including money or credentials. Extensive research studies
highlight the critical importance of implementing DMARC and SPF protocols
to mitigate such risks.
If you need further assistance or have any additional questions, please
feel free to reach out. I'm here to help. I would like to mention that I'm
looking forward to being eligible for a bug bounty reward through the
responsible disclosure of this issue. Once this matter is addressed and
resolved, I hope to report any additional bugs that I may come across.
Fix:
Please let me know if you need any assistance with resolving this issue
Thank you and regards,
Ivan
Re: Vulnerability Detected, Remediation Required
Posted by Elizabeth Thompson <el...@preset.io.INVALID>.
Also to comply with the Apache guidelines, we strongly recommend submitting any security vulnerabilities to security@superset.apache.org <ma...@superset.apache.org> instead of to the dev list. More information on these guidelines can be found here: https://www.apache.org/security/#reporting-a-vulnerability
> On Mar 20, 2024, at 3:25 PM, Tai Dupree <td...@gmail.com> wrote:
>
> Hi Ivan,
>
> Thanks for reporting this vulnerability and following up. I've forwarded this to the Apache infra team as they own the DNS records. Hopefully someone from that team will follow up with you.
>
> Best,
>
> On Wed, Mar 20, 2024 at 2:50 PM Ivan <ivan.securebyte@gmail.com <ma...@gmail.com>> wrote:
>> Hello,
>>
>> Would you kindly give me an update? On this.
>>
>> Best Regards,
>> Ivan
>>
>> On Tue, Jan 9, 2024 at 3:48 PM Ivan <ivan.securebyte@gmail.com <ma...@gmail.com>> wrote:
>>> Greetings,
>>>
>>> As a bug bounty hunter and web security researcher, my main objective is to protect the internet from cyberattacks. I specialize in identifying and reporting bugs on websites, providing comprehensive vulnerability assessment reports that detail the identified issues. During my recent research efforts, I came across your website, ‘superset.apache.org <http://superset.apache.org/>’.
>>>
>>> Vulnerability: Missing DMARC Record
>>>
>>> DMARC is an email authentication protocol designed to help domain owners protect their domains from unauthorized use, specifically email spoofing. Its implementation aims to defend against business email compromise attacks, phishing emails, email scams, and other cyber threats. A DMARC Record includes a policy that determines how unauthenticated or forged emails should be handled. The absence of this record creates an opportunity for attackers to exploit the domain name. On your website, I discovered a similar issue where anyone can send emails from Your Email: dev@superset.apache.org <ma...@superset.apache.org> to other users.
>>>
>>> By using the following DMARC record, I successfully sent a manipulated email to my own address, making it appear as if it originated from Contact Form: dev@superset.apache.org <ma...@superset.apache.org>
>>>
>>> Screenshot Proof-of-Concept


>>>
>>> Impact:
>>>
>>> This phishing technique can be highly effective, allowing attackers to send forged emails from your domain and impersonate your company's official representatives. They can manipulate victims into providing sensitive information, including money or credentials. Extensive research studies highlight the critical importance of implementing DMARC and SPF protocols to mitigate such risks.
>>>
>>> If you need further assistance or have any additional questions, please feel free to reach out. I'm here to help. I would like to mention that I'm looking forward to being eligible for a bug bounty reward through the responsible disclosure of this issue. Once this matter is addressed and resolved, I hope to report any additional bugs that I may come across.
>>> Fix:
>>>
>>> Please let me know if you need any assistance with resolving this issue
>>>
>>> Thank you and regards,
>>>
>>> Ivan
>
>
> --
> -Tai Dupree
Re: Vulnerability Detected, Remediation Required
Posted by Tai Dupree <td...@gmail.com>.
Hi Ivan,
All security related issues should be reported to security@apache.org, more
details on this available here https://www.apache.org/security/. The Apache
Foundation does not offer any financial reward for security discoveries,
however if a CVE is published as a result of a report, we generally give
credit to the original reporter.
Best,
On Mon, Apr 1, 2024 at 3:21 AM Ivan <iv...@gmail.com> wrote:
> Hello,
>
> Would you kindly give me an update? On this.
>
> Best Regards,
> Ivan
>
> On Wed, Mar 27, 2024 at 8:50 AM Ivan <iv...@gmail.com> wrote:
>
>> Hello Tai,
>> I am really sorry for the delay in my response. I would also like to
>> thank you for your email and for providing updates on the reported issue.
>>
>> I appreciate the team's response, however in my past experience I have
>> noticed that a lot of companies do not utilize the use of DMARC and also
>> SPF records. But in reality these 2 configurations play a very important
>> role in the deliverability of emails. In the past, I have reported such
>> issues to my other clients as well and they have successfully taken steps
>> and also remediated this issue as well by simply adding a DMARC record and
>> enabling Quarantine/Reject Policy.
>> However, if the team determined this as not important then I guess they
>> won't fix this.
>>
>> I just wanted to ask that if I notice any other issue and I report it to
>> you would that be considered for some reward if it is previously unknown?
>> I really hope to hear from you soon.
>>
>> Thank you :)
>>
>> On Thu, Mar 21, 2024 at 6:19 AM Tai Dupree <td...@gmail.com> wrote:
>>
>>> Hi Ivan,
>>>
>>> Apache Infra got back to us and they do not accept this as a
>>> vulnerability, as DMARC is entirely optional and the RFC
>>> <https://datatracker.ietf.org/doc/html/rfc6376#section-6.3> mentions:
>>>
>>>
>>> "In general, modules that consume DKIM verification output SHOULD NOT
>>> determine message acceptability based solely on a lack of any
>>> signature or on an unverifiable signature..."
>>>
>>> Best,
>>>
>>>
>>>
>>> On Wed, Mar 20, 2024 at 3:25 PM Tai Dupree <td...@gmail.com> wrote:
>>>
>>>> Hi Ivan,
>>>>
>>>> Thanks for reporting this vulnerability and following up. I've
>>>> forwarded this to the Apache infra team as they own the DNS records.
>>>> Hopefully someone from that team will follow up with you.
>>>>
>>>> Best,
>>>>
>>>> On Wed, Mar 20, 2024 at 2:50 PM Ivan <iv...@gmail.com> wrote:
>>>>
>>>>> Hello,
>>>>>
>>>>> Would you kindly give me an update? On this.
>>>>>
>>>>> Best Regards,
>>>>> Ivan
>>>>>
>>>>> On Tue, Jan 9, 2024 at 3:48 PM Ivan <iv...@gmail.com> wrote:
>>>>>
>>>>>> Greetings,
>>>>>>
>>>>>> As a bug bounty hunter and web security researcher, my main objective
>>>>>> is to protect the internet from cyberattacks. I specialize in identifying
>>>>>> and reporting bugs on websites, providing comprehensive vulnerability
>>>>>> assessment reports that detail the identified issues. During my recent
>>>>>> research efforts, I came across your website, ‘superset.apache.org’.
>>>>>>
>>>>>> Vulnerability: Missing DMARC Record
>>>>>>
>>>>>> DMARC is an email authentication protocol designed to help domain
>>>>>> owners protect their domains from unauthorized use, specifically email
>>>>>> spoofing. Its implementation aims to defend against business email
>>>>>> compromise attacks, phishing emails, email scams, and other cyber threats.
>>>>>> A DMARC Record includes a policy that determines how unauthenticated or
>>>>>> forged emails should be handled. The absence of this record creates an
>>>>>> opportunity for attackers to exploit the domain name. On your website, I
>>>>>> discovered a similar issue where anyone can send emails from Your Email:
>>>>>> dev@superset.apache.org to other users.
>>>>>>
>>>>>> By using the following DMARC record, I successfully sent a
>>>>>> manipulated email to my own address, making it appear as if it originated
>>>>>> from Contact Form: dev@superset.apache.org
>>>>>>
>>>>>> Screenshot Proof-of-Concept
>>>>>> [image: image.png]
>>>>>> [image: image.png]
>>>>>>
>>>>>> Impact:
>>>>>>
>>>>>> This phishing technique can be highly effective, allowing attackers
>>>>>> to send forged emails from your domain and impersonate your company's
>>>>>> official representatives. They can manipulate victims into providing
>>>>>> sensitive information, including money or credentials. Extensive research
>>>>>> studies highlight the critical importance of implementing DMARC and SPF
>>>>>> protocols to mitigate such risks.
>>>>>>
>>>>>> If you need further assistance or have any additional questions,
>>>>>> please feel free to reach out. I'm here to help. I would like to mention
>>>>>> that I'm looking forward to being eligible for a bug bounty reward through
>>>>>> the responsible disclosure of this issue. Once this matter is addressed and
>>>>>> resolved, I hope to report any additional bugs that I may come across.
>>>>>> Fix:
>>>>>>
>>>>>> Please let me know if you need any assistance with resolving this
>>>>>> issue
>>>>>>
>>>>>> Thank you and regards,
>>>>>>
>>>>>> Ivan
>>>>>>
>>>>>
>>>>
>>>> --
>>>> -Tai Dupree
>>>>
>>>
>>>
>>> --
>>> -Tai Dupree
>>>
>>
--
-Tai Dupree
Re: Vulnerability Detected, Remediation Required
Posted by Ivan <iv...@gmail.com>.
Hello Tai,
I am really sorry for the delay in my response. I would also like to thank
you for your email and for providing updates on the reported issue.
I appreciate the team's response, however in my past experience I have
noticed that a lot of companies do not utilize the use of DMARC and also
SPF records. But in reality these 2 configurations play a very important
role in the deliverability of emails. In the past, I have reported such
issues to my other clients as well and they have successfully taken steps
and also remediated this issue as well by simply adding a DMARC record and
enabling Quarantine/Reject Policy.
However, if the team determined this as not important then I guess they
won't fix this.
I just wanted to ask that if I notice any other issue and I report it to
you would that be considered for some reward if it is previously unknown?
I really hope to hear from you soon.
Thank you :)
On Thu, Mar 21, 2024 at 6:19 AM Tai Dupree <td...@gmail.com> wrote:
> Hi Ivan,
>
> Apache Infra got back to us and they do not accept this as a
> vulnerability, as DMARC is entirely optional and the RFC
> <https://datatracker.ietf.org/doc/html/rfc6376#section-6.3> mentions:
>
>
> "In general, modules that consume DKIM verification output SHOULD NOT
> determine message acceptability based solely on a lack of any
> signature or on an unverifiable signature..."
>
> Best,
>
>
>
> On Wed, Mar 20, 2024 at 3:25 PM Tai Dupree <td...@gmail.com> wrote:
>
>> Hi Ivan,
>>
>> Thanks for reporting this vulnerability and following up. I've forwarded
>> this to the Apache infra team as they own the DNS records. Hopefully
>> someone from that team will follow up with you.
>>
>> Best,
>>
>> On Wed, Mar 20, 2024 at 2:50 PM Ivan <iv...@gmail.com> wrote:
>>
>>> Hello,
>>>
>>> Would you kindly give me an update? On this.
>>>
>>> Best Regards,
>>> Ivan
>>>
>>> On Tue, Jan 9, 2024 at 3:48 PM Ivan <iv...@gmail.com> wrote:
>>>
>>>> Greetings,
>>>>
>>>> As a bug bounty hunter and web security researcher, my main objective
>>>> is to protect the internet from cyberattacks. I specialize in identifying
>>>> and reporting bugs on websites, providing comprehensive vulnerability
>>>> assessment reports that detail the identified issues. During my recent
>>>> research efforts, I came across your website, ‘superset.apache.org’.
>>>>
>>>> Vulnerability: Missing DMARC Record
>>>>
>>>> DMARC is an email authentication protocol designed to help domain
>>>> owners protect their domains from unauthorized use, specifically email
>>>> spoofing. Its implementation aims to defend against business email
>>>> compromise attacks, phishing emails, email scams, and other cyber threats.
>>>> A DMARC Record includes a policy that determines how unauthenticated or
>>>> forged emails should be handled. The absence of this record creates an
>>>> opportunity for attackers to exploit the domain name. On your website, I
>>>> discovered a similar issue where anyone can send emails from Your Email:
>>>> dev@superset.apache.org to other users.
>>>>
>>>> By using the following DMARC record, I successfully sent a manipulated
>>>> email to my own address, making it appear as if it originated from Contact
>>>> Form: dev@superset.apache.org
>>>>
>>>> Screenshot Proof-of-Concept
>>>> [image: image.png]
>>>> [image: image.png]
>>>>
>>>> Impact:
>>>>
>>>> This phishing technique can be highly effective, allowing attackers to
>>>> send forged emails from your domain and impersonate your company's official
>>>> representatives. They can manipulate victims into providing sensitive
>>>> information, including money or credentials. Extensive research studies
>>>> highlight the critical importance of implementing DMARC and SPF protocols
>>>> to mitigate such risks.
>>>>
>>>> If you need further assistance or have any additional questions, please
>>>> feel free to reach out. I'm here to help. I would like to mention that I'm
>>>> looking forward to being eligible for a bug bounty reward through the
>>>> responsible disclosure of this issue. Once this matter is addressed and
>>>> resolved, I hope to report any additional bugs that I may come across.
>>>> Fix:
>>>>
>>>> Please let me know if you need any assistance with resolving this issue
>>>>
>>>> Thank you and regards,
>>>>
>>>> Ivan
>>>>
>>>
>>
>> --
>> -Tai Dupree
>>
>
>
> --
> -Tai Dupree
>
Re: Vulnerability Detected, Remediation Required
Posted by Tai Dupree <td...@gmail.com>.
Hi Ivan,
Apache Infra got back to us and they do not accept this as a vulnerability,
as DMARC is entirely optional and the RFC
<https://datatracker.ietf.org/doc/html/rfc6376#section-6.3> mentions:
"In general, modules that consume DKIM verification output SHOULD NOT
determine message acceptability based solely on a lack of any
signature or on an unverifiable signature..."
Best,
On Wed, Mar 20, 2024 at 3:25 PM Tai Dupree <td...@gmail.com> wrote:
> Hi Ivan,
>
> Thanks for reporting this vulnerability and following up. I've forwarded
> this to the Apache infra team as they own the DNS records. Hopefully
> someone from that team will follow up with you.
>
> Best,
>
> On Wed, Mar 20, 2024 at 2:50 PM Ivan <iv...@gmail.com> wrote:
>
>> Hello,
>>
>> Would you kindly give me an update? On this.
>>
>> Best Regards,
>> Ivan
>>
>> On Tue, Jan 9, 2024 at 3:48 PM Ivan <iv...@gmail.com> wrote:
>>
>>> Greetings,
>>>
>>> As a bug bounty hunter and web security researcher, my main objective is
>>> to protect the internet from cyberattacks. I specialize in identifying and
>>> reporting bugs on websites, providing comprehensive vulnerability
>>> assessment reports that detail the identified issues. During my recent
>>> research efforts, I came across your website, ‘superset.apache.org’.
>>>
>>> Vulnerability: Missing DMARC Record
>>>
>>> DMARC is an email authentication protocol designed to help domain owners
>>> protect their domains from unauthorized use, specifically email spoofing.
>>> Its implementation aims to defend against business email compromise
>>> attacks, phishing emails, email scams, and other cyber threats. A DMARC
>>> Record includes a policy that determines how unauthenticated or forged
>>> emails should be handled. The absence of this record creates an opportunity
>>> for attackers to exploit the domain name. On your website, I discovered a
>>> similar issue where anyone can send emails from Your Email:
>>> dev@superset.apache.org to other users.
>>>
>>> By using the following DMARC record, I successfully sent a manipulated
>>> email to my own address, making it appear as if it originated from Contact
>>> Form: dev@superset.apache.org
>>>
>>> Screenshot Proof-of-Concept
>>> [image: image.png]
>>> [image: image.png]
>>>
>>> Impact:
>>>
>>> This phishing technique can be highly effective, allowing attackers to
>>> send forged emails from your domain and impersonate your company's official
>>> representatives. They can manipulate victims into providing sensitive
>>> information, including money or credentials. Extensive research studies
>>> highlight the critical importance of implementing DMARC and SPF protocols
>>> to mitigate such risks.
>>>
>>> If you need further assistance or have any additional questions, please
>>> feel free to reach out. I'm here to help. I would like to mention that I'm
>>> looking forward to being eligible for a bug bounty reward through the
>>> responsible disclosure of this issue. Once this matter is addressed and
>>> resolved, I hope to report any additional bugs that I may come across.
>>> Fix:
>>>
>>> Please let me know if you need any assistance with resolving this issue
>>>
>>> Thank you and regards,
>>>
>>> Ivan
>>>
>>
>
> --
> -Tai Dupree
>
--
-Tai Dupree
Re: Vulnerability Detected, Remediation Required
Posted by Tai Dupree <td...@gmail.com>.
Hi Ivan,
Thanks for reporting this vulnerability and following up. I've forwarded
this to the Apache infra team as they own the DNS records. Hopefully
someone from that team will follow up with you.
Best,
On Wed, Mar 20, 2024 at 2:50 PM Ivan <iv...@gmail.com> wrote:
> Hello,
>
> Would you kindly give me an update? On this.
>
> Best Regards,
> Ivan
>
> On Tue, Jan 9, 2024 at 3:48 PM Ivan <iv...@gmail.com> wrote:
>
>> Greetings,
>>
>> As a bug bounty hunter and web security researcher, my main objective is
>> to protect the internet from cyberattacks. I specialize in identifying and
>> reporting bugs on websites, providing comprehensive vulnerability
>> assessment reports that detail the identified issues. During my recent
>> research efforts, I came across your website, ‘superset.apache.org’.
>>
>> Vulnerability: Missing DMARC Record
>>
>> DMARC is an email authentication protocol designed to help domain owners
>> protect their domains from unauthorized use, specifically email spoofing.
>> Its implementation aims to defend against business email compromise
>> attacks, phishing emails, email scams, and other cyber threats. A DMARC
>> Record includes a policy that determines how unauthenticated or forged
>> emails should be handled. The absence of this record creates an opportunity
>> for attackers to exploit the domain name. On your website, I discovered a
>> similar issue where anyone can send emails from Your Email:
>> dev@superset.apache.org to other users.
>>
>> By using the following DMARC record, I successfully sent a manipulated
>> email to my own address, making it appear as if it originated from Contact
>> Form: dev@superset.apache.org
>>
>> Screenshot Proof-of-Concept
>> [image: image.png]
>> [image: image.png]
>>
>> Impact:
>>
>> This phishing technique can be highly effective, allowing attackers to
>> send forged emails from your domain and impersonate your company's official
>> representatives. They can manipulate victims into providing sensitive
>> information, including money or credentials. Extensive research studies
>> highlight the critical importance of implementing DMARC and SPF protocols
>> to mitigate such risks.
>>
>> If you need further assistance or have any additional questions, please
>> feel free to reach out. I'm here to help. I would like to mention that I'm
>> looking forward to being eligible for a bug bounty reward through the
>> responsible disclosure of this issue. Once this matter is addressed and
>> resolved, I hope to report any additional bugs that I may come across.
>> Fix:
>>
>> Please let me know if you need any assistance with resolving this issue
>>
>> Thank you and regards,
>>
>> Ivan
>>
>
--
-Tai Dupree
Re: Vulnerability Detected, Remediation Required
Posted by Ivan <iv...@gmail.com>.
Hello,
Would you kindly give me an update? On this.
Best Regards,
Ivan
On Tue, Jan 9, 2024 at 3:48 PM Ivan <iv...@gmail.com> wrote:
> Greetings,
>
> As a bug bounty hunter and web security researcher, my main objective is
> to protect the internet from cyberattacks. I specialize in identifying and
> reporting bugs on websites, providing comprehensive vulnerability
> assessment reports that detail the identified issues. During my recent
> research efforts, I came across your website, ‘superset.apache.org’.
>
> Vulnerability: Missing DMARC Record
>
> DMARC is an email authentication protocol designed to help domain owners
> protect their domains from unauthorized use, specifically email spoofing.
> Its implementation aims to defend against business email compromise
> attacks, phishing emails, email scams, and other cyber threats. A DMARC
> Record includes a policy that determines how unauthenticated or forged
> emails should be handled. The absence of this record creates an opportunity
> for attackers to exploit the domain name. On your website, I discovered a
> similar issue where anyone can send emails from Your Email:
> dev@superset.apache.org to other users.
>
> By using the following DMARC record, I successfully sent a manipulated
> email to my own address, making it appear as if it originated from Contact
> Form: dev@superset.apache.org
>
> Screenshot Proof-of-Concept
> [image: image.png]
> [image: image.png]
>
> Impact:
>
> This phishing technique can be highly effective, allowing attackers to
> send forged emails from your domain and impersonate your company's official
> representatives. They can manipulate victims into providing sensitive
> information, including money or credentials. Extensive research studies
> highlight the critical importance of implementing DMARC and SPF protocols
> to mitigate such risks.
>
> If you need further assistance or have any additional questions, please
> feel free to reach out. I'm here to help. I would like to mention that I'm
> looking forward to being eligible for a bug bounty reward through the
> responsible disclosure of this issue. Once this matter is addressed and
> resolved, I hope to report any additional bugs that I may come across.
> Fix:
>
> Please let me know if you need any assistance with resolving this issue
>
> Thank you and regards,
>
> Ivan
>