social media network

corporate

Portuguese

REC7iLP4Q

ssr-tz

_sapid

csrftoken

sense_sa_r

shopee_webUnique_ccd

_QPWSDCXHZQA

Within the Brazilian country-code top-level domain (.com.br), 'shopee.com.br' is registered without a subdomain. Count 6 characters in 'shopee' with three vowels and three consonants. Word splitting yields two words: shop, ee. Median word length is 3 characters. No strong language cues emerged from the frequency lists.

html/f4/a6/f4a6357d-48f8-4997-9f91-6fbfcb14bd91.html.gz

frame-ancestors 'self' *.wallet.airpay.com.br *.shopee.kr *.airpay.com.br *.shopeemobile.com *.shopee.com.br *.shopee.cn *.shopee.io *.facebook.com *.dailyshopee.vn migoo.ai;

script-src 'self' translate.googleapis.com translate.google.com www.google-analytics.com static.mcc.miui.com connect.facebook.net shopee.sg images.uc.cn g.alicdn.com blob:; object-src 'none'; report-uri https://secreporter.susercontent.com/csp

7cb049b4cd3021569e2f262317f0c7cbc53ee4f89a028a63ee42a0aeba269812

179b1b317c1796ec5b19380a5ae722d8d1a9a0e7cbaa11cab14742bfb97f5e95

3b5350cfbb83ebb6c5234e5c2ab439aeb6b88505f739d40db0c6e225c24688b7

77f96e79300f03f3f77aeca6cfcf0b253fd98178320bc848658f51e491d91ae5

073c07ccc058cdcb1f8bcee75aefd8af099e695f08ddd6067e677aa920025d93

133fa1c7cb3d96fa2a9605071af26c4df6ba8f95bfc8a8d0fde2bc36d2b616d2

c74df7b20a5da3d9e42bb7b728635271a4f64a001e2c111b0e0bc9bc47dfe376

c7335342a7587cf31f28d7b9bacb606b9dbd626386e5a113928245d6e5442520

c60901736efa4e7e91dfdb5ca1ae9165ed0fd6cb4efaeff9cd81e906b194c3e4

a53925edcf35411f6b6537725fc001d6e25085e83474fa9739a37cd8177f6223

7c99870a0dad3aac1f666bdec08282f04681f234ad4c238badce90e3aa628759

f2459aacf3ccb654780c033f944ceb5f8b44b7eda9aecc220f7f3e52ea8484df

87acf070c709589ff5e5648ab780411552dcb8035bbcf32c69310719c0930dee

9f2161c62340445b2a7fb37a5640fed55128bbf65f38e95bafdbb7287652b882

f41da76d739eb08b176dfe2a42ab4f5cf0ff70acc3d6efd7679a454ffc12654f

5f8dbcbdca54c9e1a23bb72026cb6102c1786a90450442c03fa7f2faebcf9b6c

1cf235f76368b224160491ae51a029321508329813c6ec59f3f22daf583fbce9

03df1092a4348f72d4575b5d67c16715c8c04fc191a39948568673f69a442d97

84ca7d64d30138d8a8e30d661a406ec8a945c897b75ea09f3fd8733b60c84c18

63ad6373652cda5f212397c21cc488b39399c6eef509480e2810e8ccf47928c9

0020c00733ffd415fd4049ff11a2bff19eaad94a09bf4e982945fe680af1a8bd

977c1d9f3889205e54bb2a10a0f9b49ddb4a65f40a1f1f0b4b2af10857ddc1d4

70aadb355b7d5f42004ad555a991013eb42f0b3ddebd383217a2119fe5255be4

6b6259e3dc5aed9315e867e4c7fb0553288138f68ae0dff7e72c51f16f6c93da

47235db26fd4f5708bff4b6ee57f466af367e6cc81157306d9c461d4b97562f1

32f52a3164b84fff5a18a98cfc03d20cff23feffd843327a96509b80edefe5f6

1b2158b3c303960cb312f01136fada387fa2cf28d04baa0cae21fda3ad2458c8

e5e7d1efdd0f371f77a9bea715cacd2f9dbc34800c0149ed016c73c92c77dec5

10301fd356c3995edc5319cf81e9fdc7d5973d9fc996fc74d7bb10d57ece177e

fdc9e3a106ad098f25119b52e6121e9892efb596436531a88456ec937fb62b21

c654a46a90fd971492e5f70b9f03a3e8b05d1bd9c4a9abcd68582f8590c86a7c

9b278f159bf532a0ebc7748355f76f9a8b5942db57a2668bebc573e81055d2df

b6d5bc29c54ac0cda5ed031c8cfcb4114e460b06a8ecdd8bbbe026382af68059

79ecfd5732e27f276aff522a0e27891a1e005587b5484f22759e0e97fbe5cc38

541f0e3629595e345f61ddce535c30009a11809b7975df85ad4c53f807bf3d56

35e84a676e4f1aaa1795d832a1d6a2bdea6188284320b9222bd0c03192b96630

614d157a0b3a35848f1f3a8a165814fa4e5aefbdff75adce7866d4843e208d34

3c219f0a1158546b2e6dbc57ec2aac6ade5499b1e24e7ec5ff88d2ed1ad03f76

06ac7fbe666c9c4d8a163276c1ec5de2094256c5e08d38373c0331252d9842e7

5a9479db0b4ceb60b9f736ed255fffa3879583081e370e1e618c5d54039e4670

6bbcdf505ea6db1f3b8169891e9f307cbaea4784d3a883211944c8137969a159

1ce332d6a10ef2e7a713a0a63f2d0b8bcb720992bb5d3abad2032c9f9b08b6e6

63ce45aadf05921a3e9265146e836834add005fd3ee73c1ab8d4f8f66c7dbc54

e5ebd51f793828fa7cfeb2c0adfe306d991b19be5d6dc0b4c3f1b525dd5fecf4

b7f2ee5de1db517f0a6335d6c553cf078bd297074320ff796e688cb91800ca80

6005268d3fdc4b0b86cc1e6701e0f4115a32a62df404408589210127eb2ff2e8

2fcd10a405c8ad6ddc67971b48e4fcb45f75e4fdb36b5920075c721a7fc457bb

53db04f09f106f93d6530f094470e509259cd1adb0ff581ec9c2b3f0dab74441

1628cc1e2103f8b7e393cc5dd4076b4d56b03dcb365d6c9bf6ee298b261b0f57

5b7f9f07ee8841a20ca4e62e391cff7f2815a1bd0231e7fd6482f9fbb63338a9

de8a05e1dee0a786cac337cac16c6d48f09958f8f09dde3d53e1e31f94b6f7b5

9596f381dd714c3ceb31c8becf25ff5aa7c82712756a252a7dd701f2e2504e3c

a567840b427a43e3c565771cf5d849f3795ce0e2e39fcc63ef74dde421241034

5e812349ddb1d500755d834c264070174fb0476f2745c6a878e17d0a71bc10c8

99bf257e2eb47876ea68a1e5a3fbd2342d7fd2dfb5cb5fc2abbeab5a3365fa07

fcc2f8313221a190dd80167b5a17b45180224d66095c03869b204ec40f283f55

11bdd07c6ef09143e3fa17ea3064bc835a9cc85db2b86b6e12643885c58feed1

e814077ef11e54ebec8c93f3715f147abd846ddfebd350d1acdbd723bf65c8c2

0ecbb86ac4497d080c7aa728c51a5396b45bc1d2f89315ff18b37a11e1355a57

9b6315257548fdd9f4f6016758311c5490c7e18c511bf6e2e1850f33f2832e67

0cb23071f064a9ad9b0690ab993cdcb3097ace55f45a4cb093edfdc0a4a803ab

26b5187311f4aa79ab22956913f68988e605f9540dfca12143efbf7831ae24b7

8bcd23210f8a34b13b16bff699314f979e4bc893d74188766a7d85a2c7762a2c

a141a191bdae005d85aefe521c6d0521bb20a6dac2544f0e727b8008feddade4

f72cbe62b8d282f991f7aa401149aabcc06888dcb37c7489d0221227836b8191

773a64d5f2a73323f1105a03658760e3022e0eba78b8c76b552bc0cf32de70af

628a0c449d859f25d2d702679e99ac927bc553e96f7c71fdc351c28d059acd29

8915414dc117331f3905e8296e39ca8587f34abf5be2a0cb9b9c02a7570b31c7

8ec418acd9cbe08de0df00edc4ce61ae996249aabb57708a9c893c4e60b933b0

08e7f1f5b9cad7376c1059e067cfecc4a440947d9f72fe41fd22c11b61b70758

3cce572a4661b3b7cfd90867a8577a9520fe640b19576be14940ec33e8cf3785

Axios Cross-Site Request Forgery Vulnerability

axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL

## Summary

When Axios runs on Node.js and is given a URL with the `data:` scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory (`Buffer`/`Blob`) and returns a synthetic 200 response.
This path ignores `maxContentLength` / `maxBodyLength` (which only protect HTTP responses), so an attacker can supply a very large `data:` URI and cause the process to allocate unbounded memory and crash (DoS), even if the caller requested `responseType: 'stream'`.

# Denial of Service via **proto** Key in mergeConfig

### Summary

The `mergeConfig` function in axios crashes with a TypeError when processing configuration objects containing `__proto__` as an own property. An attacker can trigger this by providing a malicious configuration object created via `JSON.parse()`, causing complete denial of service.

### Details

The vulnerability exists in `lib/core/mergeConfig.js` at lines 98-101:

```javascript
utils.forEach(Object.keys({ ...config1, ...config2 }), function computeConfigValue(prop) {
  const merge = mergeMap[prop] || mergeDeepProperties;
  const configValue = merge(config1[prop], config2[prop], prop);
  (utils.isUndefined(configValue) && merge !== mergeDirectKeys) || (config[prop] = configValue);
});
```

When `prop` is `'__proto__'`:

1. `JSON.parse('{"__proto__": {...}}')` creates an object with `__proto__` as an own enumerable property
2. `Object.keys()` includes `'__proto__'` in the iteration
3. `mergeMap['__proto__']` performs prototype chain lookup, returning `Object.prototype` (truthy object)
4. The expression `mergeMap[prop] || mergeDeepProperties` evaluates to `Object.prototype`
5. `Object.prototype(...)` throws `TypeError: merge is not a function`

The `mergeConfig` function is called by:

- `Axios._request()` at `lib/core/Axios.js:75`
- `Axios.getUri()` at `lib/core/Axios.js:201`
- All HTTP method shortcuts (`get`, `post`, etc.) at `lib/core/Axios.js:211,224`

### PoC

```javascript
import axios from "axios";

const maliciousConfig = JSON.parse('{"__proto__": {"x": 1}}');
await axios.get("https://httpbin.org/get", maliciousConfig);
```

**Reproduction steps:**

1. Clone axios repository or `npm install axios`
2. Create file `poc.mjs` with the code above
3. Run: `node poc.mjs`
4. Observe the TypeError crash

**Verified output (axios 1.13.4):**

```
TypeError: merge is not a function
    at computeConfigValue (lib/core/mergeConfig.js:100:25)
    at Object.forEach (lib/utils.js:280:10)
    at mergeConfig (lib/core/mergeConfig.js:98:9)
```

**Control tests performed:**
| Test | Config | Result |
|------|--------|--------|
| Normal config | `{"timeout": 5000}` | SUCCESS |
| Malicious config | `JSON.parse('{"__proto__": {"x": 1}}')` | **CRASH** |
| Nested object | `{"headers": {"X-Test": "value"}}` | SUCCESS |

**Attack scenario:**
An application that accepts user input, parses it with `JSON.parse()`, and passes it to axios configuration will crash when receiving the payload `{"__proto__": {"x": 1}}`.

### Impact

**Denial of Service** - Any application using axios that processes user-controlled JSON and passes it to axios configuration methods is vulnerable. The application will crash when processing the malicious payload.

Affected environments:

- Node.js servers using axios for HTTP requests
- Any backend that passes parsed JSON to axios configuration

This is NOT prototype pollution - the application crashes before any assignment occurs.

Versions before 1.6.8 depends on follow-redirects before 1.15.6 which could leak the proxy authentication credentials

2072f2f961f0135b1f27ef62ca7e3426f971480ed4784f63c02a0c65a58363e9

c38caa5dc949993f92a274b6e2134c8e6cc577a3e93110774efc42ec04688e7c

d367554996c89930da863a035df90b70cccfeba60276c7fe05580d1a60404426

19cb4204f251daad485682f921a508225693681b251924b4729f29dda9ef35df

14938ad9e5113224148b12373e2b9828892b0462de4b1d67c2e248a16f78a217

0798c8afee465a59620eb5885eb12b8c595d6374b52a8cc503559214277ca103

00a0110f98862a66ef318721e26d409884dc05e636d09596b480bb58db541571

a6d3dca5849be1e74df801b1aa0c54a6b9a41fc68694a88d829210492c5c73e9

2fbc4b3fec23db0e370ed242ccb8126a9bc8ec10f34d35529b5bd07e5f99e569

4703de94cc5a96da9fe28c9ac55b00adbc433fd579e48cf8b420702a54ea5d3c

27f201cf6670f4b009ff1659180e92c6a865437405c12f0cf086fea31a42d273

91ecba39816ceceb3922f9c6b1b28b0be885e60e067236a1f97f253b069d2fbf

dd237a349cede0425c5d116dc71529789b73d3c58513192c410878305a1e479a

155a41ede03d5e8c4de508fe5cd7faece76f4a0c50c95cf6a6e4fa61b9e6a97f

bbace84dba5aad644dde0b4c50265c0df358e70f1badda7158fbc406dfd577e4

6d981ea9970d1dd80c07356d306dba948aabc8cc005f0eb6613c72bdd7e1561b

34ca91d385a5885a56a9a80c569287cee5dfb098e8aa84ead4e793d7166d1eaf

603eebbc8fb7f485af150393c5c052087f5b2556d72e4c21d559b6709b213c9f

viewport

shopee:git-sha

shopee:version

theme-color

robots

https://deo.shopeemobile.com/shopee/shopee-pcmall-live-sg/homepagefe/26c9324913c021677768.png

msvalidate.01

1ba832b5763f71544fe8b6f29a003193997e35e5448e585df071910f83597119

ahrefs-site-verification

Shopee Brasil | Na Shopee Compensa Mais | Frete Grátis e Cupons

Descubra a plataforma de compras on-line Shopee. Compre em menos de 30 segundos: a qualquer hora e em qualquer lugar. Garantia Shopee | Ofertas Relâmpago

description

HSTS header missing - vulnerable to protocol downgrade attacks

CSP header missing - vulnerable to XSS attacks

child-src 'none';object-src 'none';require-trusted-types-for 'script';script-src chrome://resources 'self';trusted-types;worker-src blob: 'self';frame-ancestors 'none';

child-src https:  chrome-untrusted://new-tab-page/ chrome-untrusted://ntp-microsoft-auth/;connect-src chrome://webui-test chrome://resources chrome://theme 'self';default-src 'self';font-src chrome://resources 'self';img-src chrome://resources chrome://theme chrome://image chrome://favicon2 chrome://app-icon chrome://extension-icon chrome://fileicon blob: data: 'self';object-src 'none';require-trusted-types-for 'script';script-src chrome://resources chrome://webui-test 'self';style-src chrome://resources chrome://theme 'self' 'unsafe-inline';trusted-types parse-html-subset sanitize-inner-html static-types lottie-worker-script-loader webui-test-script webui-test-html polymer-html-literal polymer-template-event-attribute-policy lit-html-desktop;frame-ancestors 'none';

child-src 'none';object-src 'none';require-trusted-types-for 'script';script-src chrome://resources 'self';trusted-types;frame-ancestors 'none';

base-uri 'none';child-src https:;form-action https://ogs.google.com https://*.corp.google.com;object-src 'none';script-src 'self' 'unsafe-inline' https:;frame-ancestors chrome://new-tab-page/

SHPS TECNOLOGIA E SERVICOS LTDA

Shopee Singapore Private Limited

shopee.com.br

Abuse-C Role

Network Architecture Role Account

AKAM1-RIPE-MNT

AKAMAI-PA

let browserYear=2017;navigator.userAgent.includes("Firefox")?Uint8Array.prototype.setFromBase64&&(browserYear=2023):Intl.DurationFormat&&(browserYear=2023),window.BROWSER_YEAR=browserYear

"loading"in HTMLImageElement.prototype?document.addEventListener("DOMContentLoaded",(()=>{document.querySelectorAll("img[loading].lazyload").forEach((e=>{e.dataset.src&&(e.src=e.dataset.src),e.dataset.srcset&&(e.srcset=e.dataset.srcset);var t,s,a=e.parentElement;if(a&&"PICTURE"===a.nodeName)for(t=a.getElementsByTagName("source"),s=0;s<t.length;s++)t[s].dataset.src&&(t[s].src=t[s].dataset.src),t[s].dataset.srcset&&(t[s].srcset=t[s].dataset.srcset)}))})):document.write('<script type="text/javascript" src="https://deo.shopeemobile.com/shopee/shopee-pcmall-live-sg/assets/polyfill.d86e5ceef3caefa1.js"><\/script>')

window.MutationObserver||document.write('<script type="text/javascript" src="https://deo.shopeemobile.com/shopee/shopee-pcmall-live-sg/assets/polyfill.6d66a9f4abfc0453.js"><\/script>')

"IntersectionObserver"in window&&"IntersectionObserverEntry"in window&&"intersectionRatio"in window.IntersectionObserverEntry.prototype&&"isIntersecting"in window.IntersectionObserverEntry.prototype||document.write('<script type="text/javascript" src="https://deo.shopeemobile.com/shopee/shopee-pcmall-live-sg/assets/polyfill.7b130ff53107c239.js"><\/script>')

(()=>{var e=document.createElement("div").style;e.setProperty&&e.setProperty("--x","x"),e.getPropertyValue&&"x"===e.getPropertyValue("--x")||(document.write('<script type="text/javascript" src="https://deo.shopeemobile.com/shopee/shopee-pcmall-live-sg/assets/polyfill.e91a033830f038f9.js"><\/script>'),document.write("<script>window.cssVars({preserveVars:!0,watch:!0});<\/script>"))})()

{"pcmall-addondeal-aod":"https://deo.shopeemobile.com/shopee/stm-sg-live/13694/asset-BR-live.f2f6ff0bbcfed6bd90fe9f0787aba051.json","pcmall-addondeal-pwg":"https://deo.shopeemobile.com/shopee/stm-sg-l

Shopee é a plataforma de compras online para quem quer fazer compras a qualquer hora e em qualquer lugar. Aproveite na Shopee uma experiência de compra online fácil, rápida e segura.

Shopee Brasil

var disableMeta=window.location&&window.location.search&&new URLSearchParams(window.location.search).get("disable_meta"),faviconLinks=[{sizes:"32x32",href:"https://deo.shopeemobile.com/shopee/shopee-pcmall-live-sg/assets/icon_favicon_1_32.9cd61b2e90c0f104.png"},{sizes:"96x96",href:"https://deo.shopeemobile.com/shopee/shopee-pcmall-live-sg/assets/icon_favicon_1_96.1ce0e05fc18a86e5.png"}];disableMeta||faviconLinks.forEach((function(e){var o=document.createElement("link");o.rel="icon",o.type="image/png",o.sizes=e.sizes,o.href=e.href,document.head.appendChild(o)}))

function loadScripts(e){const s=document.createElement("script");s.src=e,s.async=!1,s.defer=!0,s.crossOrigin="anonymous",document.body.appendChild(s)}if(2023===BROWSER_YEAR)for(var scripts=["https://deo.shopeemobile.com/shopee/shopee-pcmall-live-sg/assets/webpack-runtime.d0c2747f8d480b6d.2023.js","https://deo.shopeemobile.com/shopee/shopee-pcmall-live-sg/assets/entry-modules.498353908f2584ba.2023.js","https://deo.shopeemobile.com/shopee/shopee-pcmall-live-sg/assets/bundle.1e3e2b2412680321.2023.js"],i=0;i<scripts.length;i++)scripts[i].endsWith("2023.js")&&loadScripts(scripts[i])

Requests	IP Address	Location	AS Autonomous System
20	2.16.183.238	Hamburg, Free and Hanseatic City of Hamburg, Germany	AS20940Akamai International B.V.
20	2.19.126.154	Frankfurt am Main, Hesse, Germany	AS20940Akamai International B.V.
20	147.136.189.4	Singapore	AS138341SHOPEE SINGAPORE PRIVATE LIMITED
20	2.19.126.149	Frankfurt am Main, Hesse, Germany	AS20940Akamai International B.V.
20	147.136.187.18	United States	AS138341SHOPEE SINGAPORE PRIVATE LIMITED
20	147.136.133.189	Singapore	AS138341SHOPEE SINGAPORE PRIVATE LIMITED
20	147.136.189.6	Singapore	AS138341SHOPEE SINGAPORE PRIVATE LIMITED
140	7	-	-

Security Scan Report: shopee.com.br

Summary

AI Security Verdict

Safe Website

Safety Factors

Details

Screenshot

Page Load Overview

Language Analysis

Primary Language

Detection Details

Website Classification

Primary Category

All Detected Categories

Detected Features

Domain & IP Information

Detected Technologies4

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

ssdeep (Context Triggered Piecewise Hashing)

sdhash (Similarity Digest Hashing)

Image Hashes

Perceptual Hashes

Other Hashes

Scan History