HackerOne: Reflected Filename Download

First of all congratulations on awesome bounty system. Big fan here! I found out that it's possible run a RFD attack on Hackerone. If we visit: https://hackerone.com/dsopas We see the normal HTML webpage. Nothing new here. But if we add ?format=json to the URL we can see the JSON file generated b...

HackerOne: "learn more here", reward email - domain expired.

Hi, Today I received an e-mail about a reward, below the e-mail there is something about drastically reduced fees from Coinbase, to be exactly, the following: Thanks to drastically reduced fees from Coinbase, you are eligible to receive a 5% bonus when you receive your bounty payout in Bitcoin...

HackerOne: Open redirect in "Language change".

Hi guys! Urls: https://hackerone.com//example.com/ru/faq and https://hackerone.com//example.com/faq or https://hackerone.com//example.com/disclosure-guidelines and https://hackerone.com//example.com/ru/disclosure-guidelines scroll down at the right side change the language to English you will go ...

HackerOne: Reflected File Download attack allows attacker to 'upload' executables to hackerone.com domain

Hi hackerone team, I'm a friend of Peiying and am looking for a position at hackerone. While playing around with your product, I found a serious vulnerability in your application: it allows attackers to craft executables on the hackerone.com domain rather than the sandboxed one on S3. 1. attacker...

Adobe Starts Vulnerability Disclosure Program on HackerOne

Update: Adobe is the latest tech vendor to begin a vulnerability disclosure program, but it seems they’re limping in at the outset. The program launched this week on the HackerOne platform, but there are no cash incentives being offered and certain Adobe products are not in scope for researchers...

HackerOne: Improperly validated fields allows injection of arbitrary HTML via spoofed React objects

Note: I haven't yet investigated the implications of this fully, so this may be more severe than I'm currently aware of. Right now the only exploits I'm aware of allow a team member to attack other team members. I've found a couple fields that I'd expect to be limited to string values, but which...

HackerOne: Auto Approval of Invitation to join Team as a Team member

Hi Hackerone, I have found a vulnerability wherein once a Team manager of any team sends out an Invitation to another Hackerone user to join his team, the invited team member gets auto accepted into the team to which he is being invited to join. The choice of "Accept" or "Reject" invitation which...

HackerOne: Substantially weakened authenticity verification when using 'Remember me for a week'

Hello HackerOne, I noticed that in order to access data bound to a user's permissions, say their own bug reports, or CSRF-token, you only need one certain cookie, which is rememberusertoken, and although it is sent when the user uses HackerOne in a normal fashion, the session cookie is ignored an...

HackerOne: Team member invitations to sandboxed teams are not invalidated consistently (v2)

As per our email conversation on ticket 2527, I am giving you a proof of concept of my claim. 1. I have a sandboxed team in hackerone,named movielee. 2. The manager of that team @haxorsistz sends an invite to = ██████████ 3. The link which I received on email was =...

HackerOne: Restrict any user from logging into his account.

Hackerone's destroys user sessions automatically after signing out,changing password etc.So Old sessions are seems to be worthless for any attacker.But I found something,by exploiting this you can restrict any hackerone user to logging into his account. Pre-Requisition I just need one of his old...

HackerOne: Markdown code block sequence makes report unreadable

Proof of Concept Submitting a report/comment with an input like the following "Three backticks followed by a newline followed by -ddd/d" will cause the report to be unreadable I think it's because the parser is crashing? The attached file includes the input that I'm trying with difficulty to...

HackerOne: Markdown parsing issue enables insertion of malicious tags and event handlers

When markdown is being presented as HTML, there seems to be a strange interaction between and @ that lets an attacker insert malicious tags. Proof of Concept http://[email protected] foo=bar is rendered converted to the following HTML: html http://danlec As you can see, the output includes a tag which ca...

HackerOne: Team member invitations to sandboxed teams are not invalidated consistently

hello today i found a Bug about Auth in Send invitation to member to join the team ,, so if Now The Victim Send invition to Another Victim Account to join the team as a Manager,, the link of the invitation is will Be Valid For Many Many Many time to Accept the invtiation from Another Accounts in ...

HackerOne: Insecure Direct Object Reference vulnerability

In the program portal, there is an option to add external people as participants in a bug report. The admin can then remove this person as well if needed. The request for removing an external reporter looks like: DELETE /reports//externalusers/ HTTP/1.1 Host: hackerone.com User-Agent:...

HackerOne: In markdown, parsing things like @danlec and #46072 after links is unsafe

Let me preface this by saying that I haven't worked out an actual exploit for this, and there may not be one, but when 46072 is disclosed, folks will probably be taking a closer look at HackerOne's markdown parsing and may find a way to turn this bug into something It looks like the links for...

HackerOne: Vulnerability with the way \ escaped characters in <http://danlec.com> style links are rendered

Uh\ oh! Basic POC: Sequences like test\ are rendered as http://test Examples of what could be done with this: Obviously there's a whole variety of stuff that can be done when you can inject arbitrary HTML, even in spite of the CSP protection. We can put in elements we're not supposed to see above...

GitHub Doubles Maximum Bug Bounty Payouts

Almost a year to the day since Github announced its bug bounty program, the Git repository said yesterday that it will double its maximum payout to $10,000. Ben Toews, a GitHub staffer, said yesterday that since the launch of the GitHub Security Bug Bounty, 73 previously unknown vulnerabilities...

X (Formerly Twitter): URGENT - SUBDOMAIN TAKEOVER ON TWITTER ACQ.

Hello Twitter Security Team, I reccomend you to read this report with the maximum attention! This is the same isse that you ever see here: https://hackerone.com/reports/42236 and here https://hackerone.com/reports/32825. Well ,now, the acquisition where I found this domain is: trendrr.tv..Before...

HackerOne: Add text to the title of the page "Thanks"

Hi! We can add text to the title of the page "Thanks" Example: https://hackerone.com/mailru/thanks/2014%20Example%201111111111111111111111111...

HackerOne: HTTPS is not enforced for objects stored by HackerOne on Amazon S3

SSL is not enforced for objects stored by HackerOne on Amazon S3. Currently I see all the screenshots uploaded are stored in Amazon S3 bucket "hackerone-attachments" and by default HTTPS connection is made. However even HTTP connections are open to these URLs indicating that SSL is not enforced b...