HackerOne: (HackerOne SSO-SAML) Login CSRF, Open Redirect, and Self-XSS Possible Exploitation

Summary: Login CSRF, Open Redirect, and Self-XSS Possible Exploitation through HackerOne SSO-SAML PoC - Go to █████; Use a browser window with clear cookies. Source-code: setTimeoutfunctiondocument.location.href = "https://hackerone.com/users/saml/signin?email=████&rememberme=true";, 5000; Impact...

HackerOne: Slack integration setup lacks CSRF protection

Details: Summary: Cross-site Request Forgery in the Integrations https://hackerone.com/YOURTEAM/integrations feature for teams. Description Include Impact: The Integrations flow is insecure, because it can be abused by CSRF. PoC: Request GET https://hackerone.com/auth/slack HTTP/1.1 Response...

RubyGems: Invalid username updating

Hello Rubygems, This is my first report on Hackerone, so please tell me if you need further information. This vulnerability/glitch uses the 'Edit Profile' page. How to do it: 1. Login to any account on Rubygems 2. Go to your profile 3. Go to 'Edit Profile' 4. In Handle, put the invalid username 5...

How I snooped into your private Slack messages [Slack Bug bounty worth $2,500]

When researching about MX records of slack.com, I noticed that they used a 3rd party email service. In that service, however slack.com was already claimed. After a little more research, I found that all the sub-domains of slack.com like teamname.slack.com also had MX set to the same service. Thes...

HackerOne: Ability to enumerate private programs using SAML

@ayoubfathi found a strong indicator of the existence of some private programs which were using SAML. Although it was not definitive, and we also warn teams using SAML that doing so removes their reasonable expectation of not being discoverable, we made some changes to help teams more easily...

Yelp Launches Public Bug Bounty

For a long time, Yelp.com has been one of the Internet’s most-frequented resources for crowd-sourced local business, restaurant and hospitality reviews and tips. Starting today, the door will be open to researchers and bug-hunters who are invited to participate in Yelp’s public bug bounty. The...

HackerOne: Users contents on AWS is cacheable

Hi , Background ============================= As I know you are using AWS S3 for saving and serving files . The AWS S3 on https://hackerone-attachments.s3.amazonaws.com are been called every time to show images on hackerone.com . For example view this report 145392 You will see a request for Fran...

HackerOne: Lack of length validation on user address attribute

Hi The input fields for adding mailing address for swag delivery in https://hackerone.com/settings/swags are not restricted in input lengths. I was able to add and read the contents via my own address page and the team pagewho awards the swag over 585728 characters in each of the input fields Nam...

HackerOne: Information leakage of private program

Hello team, I noticed an issue in Directory where information of a soft-launched program getting disclosed! I made this request as an unauthecated user, http GET /programs/search?query█████████&sort=publishedat%3Adescending&page=1 HTTP/1.1 Host: hackerone.com User-Agent: Mozilla/5.0 Windows NT...

HackerOne: Hacker.One Subdomain Takeover

Hello HackerOne Sec Team, Description : This report is about domain takeover of hacker.one via instapage 0day issue which i just found . Step To Verify : + Visit : https://www.hacker.one + You will see some html updated by me. Impact : + as its one of offical website of hackerone , so attacker ca...

Certly: Business logic Failure - Browser cache management and logout vulnerability in Certly

1.login the account. 2. browse any tabs or anything in the site 3. logout the account 4.click the back browser button and you are able to see the all previous page Related Topic: https://hackerone.com/reports/7909...

HackerOne: Non-secure requests are not automatically upgraded to HTTPS

Non-secure requests to hackerone.com e.g. http://hackerone.com are not automatically upgraded to HTTPS. This is not something you would notice when you use the latest version of modern web browsers such as Google Chrome or Firefox, because hackerone.com is HSTS preloaded. When a domain is...

HackerOne: Missing rate limit on critical user actions e.g. reset password, change email, disable account.

Hi I found that there are no rate limitations present on actions that require a password inside the account settings. Actions: Paypal email change Account email change Password Change Disable Account this will not be useful to attacker These sensitive actions require additional verification of...

HackerOne: Disclosure of external users invited to a specific report

It is possible to verify whether a specific user is invited to participate as an external user to a specific report. Thus it is possible to enumerate all external users added to a specific non-public report of interest. PoC: curl 'https://hackerone.com/reports/reportid/externalusers/userid' -X...

HackerOne: Repeated mediation requests and multiple emails possible on a report.

Hi, 1 We can by pass used buttom Confirm on Request Mediation from HackerOne where is disable him POC: Edit html and delete disabled="" And buttom in active. 2 Next catch request https://hackerone.com/reports/nubmerreport/hackerhelp POST: message=&mediationtype=resolution If parametr message null...

Kaspersky Lab Bug Bounty Program Launches

LAS VEGAS – Kaspersky Lab today at Black Hat USA 2016 announced the launch of a public bug bounty, one of the few offered by a software vendor in the computer security industry. The bounty begins tomorrow on the HackerOne platform, and the first phase will run for six months. The company said tha...

PayPal Fixes CSRF Vulnerability in PayPal.me

PayPal recently fixed a vulnerability on its PayPal.me site that could have let an attacker change a user’s profile without permission. The issue stemmed from a cross-site request forgery CSRF vulnerability that existed in PayPal.me, a site the company launched last year to let its users request...

HackerOne: Reward Money Leakage

By monitoring the average bounty amounts of a team, you can infer a certain amount of information about the size of the bounties awarded, even if the team has chosen not to show bounty amounts. we have decided to close this report as Informative as we are okay with the current state of the bounty...

HackerOne: Possible CSRF during joining report as participant

Hi, I think i found a possible csrf issue with joining report as participant endpoint, Actually one of the bug got duplicated and the company added me into the original bug as a participant. then, I got invitation from hackerone to joing the report. After opening the invitation link, there was tw...

Concrete5 5.7.3.1 Local File Inclusion

------------------------------------------------------------------------------- Concrete5 installed 329. $response = $this-getEarlyDispatchResponse; 330. 331. if !isset$response 332. $collection = Route::getList; 333. $context = new \Symfony\Component\Routing\RequestContext; 334...