Security Research Report

Meemup

Target: meemup.com·Method: passive + active recon·Reported: yes·Exploited: no

Severity

Critical

Findings

5+

Origin IPs leaked

3

Open ports

15+

Responsible Disclosure

Everything here was found through passive recon and responsible testing. Nothing was exploited for personal gain. Sensitive details like IPs and internal URLs are blurred on purpose. Full breakdown available on private request.

Findings

Critical

Cloudflare Origin Bypass

Multiple subdomains leak true origin IPs, fully bypassing Cloudflare protection.

High

Massive Open Port Exposure

Origin server has an enormous exposed footprint. Ports found open:

High

Exposed Internal Documentation

Internal test pages and printer setup guides are world-readable with zero authentication.

High

Host Header Injection

The origin server blindly trusts the Host header for redirects. Affected endpoints: /login, /home, /forgot-password, /reset-password. Risk: password-reset link poisoning, cache poisoning, phishing users to a fake login page.

Medium

jQuery Selector Injection

Uses jQuery 1.12.4 — scrolling-nav.js passes an unsanitised URL hash directly into $(). Exploitable if a victim clicks a crafted anchor link.

Recommended Fixes

01

Firewall your origin IPs to Cloudflare ranges only — block everything else at the server level

02

Move docs, demo-four, and relay subdomains behind Cloudflare

03

Disable GraphQL introspection and field suggestion in Wiki.js

04

Delete or lock down internal test and printer docs pages — they're public right now

05

Rate-limit your login endpoint and IP-restrict your admin panel

06

Fix your HSTS config — max-age should be at least 1 year

07

Harden SSH, mail, and database services on your origin servers