Vendor
ransomlook
14 known vulnerabilities.
Products
8 results · Clear filters · Feed
-
High 7.0
Insecure Flask Secret-Key File Permissions Allow Local Administrator Session Forgery in RansomLook
RansomLook created its Flask session-signing key without explicitly restricting the file permissions. The secret_key file was created using the process's default permissions and umask, resulting in permissions such as 0644 under a common 022 umask. Consequent…
-
High 8.8
RansomLook Login Endpoint Allows Timing-Based Username Enumeration and Unthrottled Authentication Attempts
RansomLook contains multiple weaknesses in its authentication endpoint that allow an unauthenticated remote attacker to enumerate valid usernames, perform unrestricted password-guessing attacks, and potentially exhaust application worker resources. For local …
-
High 8.8
Stored Cross-Site Scripting via Untrusted Cryptocurrency Address Rendering in RansomLook
RansomLook contains a stored cross-site scripting (XSS) vulnerability in the cryptocurrency wallet detail view. Cryptocurrency addresses and blockchain names originating from external sources, including the public crowd-sourced ransomwhe.re feed, were stored …
-
High 8.7
Unauthenticated Disclosure of Scraping Credentials and Bypass Configuration via RansomLook API
RansomLook exposed sensitive operator-side scraping configuration through multiple unauthenticated API responses. Location records associated with ransomware groups and markets were returned largely verbatim to unauthenticated callers whenever the location it…
-
High 8.2
RansomLook Analysis PDF Generation Allows Server-Side Request Forgery and Arbitrary Local File Access
RansomLook contains insufficient resource validation in the analysis PDF generation functionality. Analysis documents are converted from Markdown to HTML and passed to WeasyPrint for PDF rendering. Prior to the fix, WeasyPrint used its default URL fetcher, al…
-
High 8.2
RansomLook Arbitrary File Read via Path Traversal in Post screen Field
RansomLook contains a path traversal vulnerability in the handling of the screen field associated with group posts. The GroupPost.get API handler concatenates the database-controlled screen value directly with the application's source/ directory and opens the…
-
High 8.7
Private Group and Market Posts Disclosed Through Public Notification Channels in RansomLook
RansomLook fails to enforce the privacy status of ransomware groups and markets when distributing newly collected victim posts to external notification channels. The post-processing logic checks whether an individual post is marked private but does not verify…
-
High 8.8
Missing Authentication Allows Unauthorized Creation of Crypto Groups in RansomLook
RansomLook contains a missing authentication vulnerability in the /admin/crypto/group/new endpoint. While the endpoint provides an administrative function for creating new crypto group entries, it was not protected by the application's authentication mechanis…