Open IPFS gateway allows hosting arbitrary contents

[cupid8917]

Clearpool Finance is hosting open IPFS instance on host ipfs-gateway.clearpool.finance. Thus allowing anyone to host any content on the affected host. This allows attacker to get Stored Cross Site Scripting as well as hosting a wallet drainer on the host.

Business Impact
This could allow an attacker to host a fake mint page with wallet drainer thus resulting into funds lost of users.

Steps to Reproduce

1. Use infura or any similar ipfs provider and upload the content to get the CID ID. (e.g
   QmYSdYGEFM2XgaaWn4d8uQUw64gWxoKBGryfDKNsFfBRvG)
2. Now go to https://ipfs-gateway.clearpool.finance/ipfs/CID_ID
3. You will notice that your content has been hosted on ipfs-gateway.clearpool.finance

Proof of Concept (PoC)
https://ipfs-gateway.clearpool.finance/ipfs/QmYSdYGEFM2XgaaWn4d8uQUw64gWxoKBGryfDKNsFfBRvG

You will notice that url in browser has been changed to /mint without navigating to make this attack look more legit.

[VarinderClearpool]

@zolotokrylin @georgeciubotaru

[zolotokrylin]

@cupid8917 thank you for your report. We have applied a patch.
You will be rewarded. Please provide your ERC20 wallet address and specify the network for the payout. Cheers!