libphutil: removing bytes from a PhutilRope does not work as intended #105657 Valid No weakness recorded – 2015-12-16 – – Extended policy checks are buggy #109959 Valid No weakness recorded – 2016-01-11 – – Abusing VCS control on phabricator #16315 Valid Access Control – 2014-06-13 $600 1 Dashboard panel embedded onto itself causes a denial of service #85011 Valid Denial of Service – 2015-08-27 – 1 Information leakage through Graphviz blocks #88395 Valid Information Disclosure – 2015-09-13 – 1 Abusing daemon logs for Privilege escalation under certain scenarios #16392 Valid Access Control – 2014-06-18 $300 2 Open redirection on secure.phabricator.com #25160 Valid Open Redirect – 2014-09-17 – 2 Phabricator Phame Blog Skins Local File Inclusion #39428 Valid Command and Code Injection – 2015-01-14 $500 2 XSS with Time-of-Day Format #52822 Valid Cross-site Scripting – 2015-04-19 – 2 Multiple so called 'type juggling' attacks. Most notably PhabricatorUser::validateCSRFToken() is 'bypassable' in certain cases. #86022 Valid Cross-Site Request Forgery – 2015-10-01 – 2 Passphrase credential lock bypass #139626 Valid Information Disclosure – 2016-05-18 – 2 XSS in editor by any user #18691 Valid Cross-site Scripting – 2014-08-13 $1,000 3 Phabricator Diffusion application allows unauthorized users to delete mirrors #38965 Valid Authentication – 2015-01-09 $300 3 Autoclose can close any task regardless of policies/spaces #220909 Valid No weakness recorded – 2017-04-24 – 3 SSRF vulnerability (access to metadata server on EC2 and OpenStack) #53088 Valid Information Disclosure – 2015-03-26 $300 4 Slowvote and Countdown can cause Denial of Service due to recursive inclusion #1563142 Valid Denial of Service – 2022-05-09 – 5 UnAuthorized Editorial Publishing to Blogs #3356 Valid Authentication – 2014-04-05 $300 7 IRC-Bot exposes information #222870 Valid Information Disclosure Medium 2017-04-21 – 7 TOTP Key is shorter than RFC 4226 recommended minimum #435648 Valid Cryptography None 2018-12-07 $300 7 Deprecated owners.query API bypasses object view policy #1584409 Valid Access Control – 2022-05-31 $300 7 Control character allowed in username #3921 Valid No weakness recorded – 2014-04-12 $300 8 Persistent XSS: Editor link #4114 Valid Cross-site Scripting – 2014-04-16 $300 8 Forgot Password Issue #23363 Valid Authentication – 2014-09-10 – 8 Fetching binaries (for software installation) over HTTP without verification (RCE as ROOT by MITM) #186352 Valid No weakness recorded – 2016-12-29 $300 8 OAuth access_token stealing in Phabricator #3596 Valid Open Redirect – 2014-04-11 $450 9 Conduit feed.publish API allows you to spoof other users or make it look like you have access to a restricted object #1566325 Valid No weakness recorded – 2022-05-18 $300 9 OAuth Stealing Attack (New) #3930 Valid Open Redirect – 2014-04-13 $400 10 Differential "Show Raw File" feature exposes generated files to unauthorised users #213942 Valid Information Disclosure Medium 2017-03-16 – 10 Global default settings page is accessible to non-administrators #1563139 Valid Access Control – 2022-05-09 $300 10 Administrator can create user without entering high security mode #351361 Valid Authentication Low 2018-05-22 – 11 HTML in Diffusion not escaped in certain circumstances #148865 Valid Cross-site Scripting – 2016-08-01 – 12 Window.opener fix bypass #317243 Valid No weakness recorded Low 2018-02-18 $300 12 Exposing voting results on the Slowvote application without actually voting #434116 Valid No weakness recorded Low 2018-11-05 $300 12 Bypass auth.email-domains (2) #2233 Valid Authentication – 2014-03-26 $500 13 Improperly implemented password recovery link functionality #809 Valid Authentication – 2014-02-27 $300 14 Login CSRF using Twitter OAuth #2228 Valid Cross-Site Request Forgery – 2014-03-26 – 14 User with only Viewing Privilege can send message to Room #202499 Valid Access Control Low 2017-02-01 $300 14 Bypass auth.email-domains Analysed #2224 Valid Authentication – 2014-03-25 $1,000 15 Possible to make restricted files public on Phabricator via Diffusion Analysed #1560717 Valid Access Control – 2022-07-29 $2,000 17 Window.opener protection Bypass Analysed #306414 Valid No weakness recorded – 2018-02-17 $300 19 User can link non-public file attachments, leading to file disclose on edit by higher-privileged user Analysed #763177 Valid Input Validation and Logic Medium 2022-06-26 $500 20 Log in a user to another account Analysed #774 Valid Cross-Site Request Forgery – 2014-02-22 $300 21 Markdown parsing issue enables insertion of malicious tags Analysed #758002 Valid Cross-site Scripting – 2019-12-13 – 21 Phabricator is vulnerable to padding oracle attacks and chosen-ciphertext attacks. Analysed #216746 Valid Cryptography Medium 2017-04-05 $750 23 Broken Authentication and Session Management Analysed #17474 Valid Authentication – 2014-08-05 – 26 SSRF in notifications.server configuration Analysed #850114 Valid Server-Side Request Forgery Medium 2020-05-15 $300 28 IDOR bug to See hidden slowvote of any user even when you dont have access right Analysed #661978 Valid Insecure Direct Object Reference – 2019-08-29 $300 36 Command injection on Phabricator instance with an evil hg branch name Analysed #288704 Valid Command and Code Injection Critical 2017-11-11 – 41 Git flag injection leads to arbitrary file write Analysed #1070247 Valid File and Path Handling High 2021-07-25 – 54