Projects
Clockify
Clockify is a popular time tracker and timesheet app for teams of all sizes.
The team was missing a major logical vulnerability in the team management functionality, and a significant path traversal bug in user account handling.
I analyzed the API requests and spotted two critical security issues:
User account takeover issue affecting 2+ million users. Exploiting path traversal bug was the entry point to this issue.
Any low privileged user could have been an admin of his team’s workspace through exploiting a logical issue presented in the team management functionality. This affected 150k+ teams.
Then I assisted the software engineers to study these bugs by presenting a step-by-step explanation video and a detailed security report of the vulnerabilities.
Highlights
Helped them grow the main API security by 200%.
Found 1 critical account takeover vulnerability that enabled hacking 2+ Million user accounts.
Uncovered 2 API security issues affecting the user verification process.
Located 1 workspace takeover vulnerability affecting 150k+ teams in Clockify application.
Helped the team to study the security vulnerability by preparing a detailed security report.
Published a technical write-up about one security finding that led to 5.7k views.
The Clockify team partially disclosed the report on their website.
Clio
Clio is a top legal software for clients, cases, billing, and more.
I went through all the features of the web application. There was 2-factor authentication in place for user accounts as extra protection. Another feature was changing the emails of the clients of a legal firm.
I found a neat trick to break the access control policy on email changing functionality. This resulted in hacking 150k+ legal professional accounts and their client accounts. It also bypassed the 2-factor authentication of user accounts.
I got a special appreciation from the security team for finding the best security issue on the Clio platform.
Highlights
Secured 150k+ lawyers' accounts from cyber-attacks.
Identified an account takeover vulnerability.
Got a special acknowledgment from the team for discovering the best critical finding in Clio API.
Built a comprehensive security report for a serious security vulnerability in their API