HackerOne: Researcher gets email updates on a private program after he/she quits that program.

Summary: I found out that after I quit private program, I still gets update about that program, e.g. new scope changes/amount of money and etc. Description Include Impact: I noticed that if I quit program I still gets email updates about the private program, private data can be leak on that email...

HackerOne: Obtain the username & the uid of the one doing the S3 sync on Hackerone

Obtain the username & uid of hackerone.com S3 using GET, it's possible to obtain the username & uid of the one doing the S3 sync on Hackerone. Doing a GET on : http://hackerone.com Give the following header : content-security-policy = default-src 'none'; base-uri 'self'; block-all-mixed-content;...

Yelp: IDNs displayed in unicode in messages/about/talk sections (Homograph Attack)

Hello Yelp, Please refer https://en.wikipedia.org/wiki/Internationalizeddomainname to know more about IDNs. The IDN Internationalized Domain Name : http://ebаy.com/ is a homograph for the latin ebay.com. if you click that first link, you might think that you are going to ebay.com but in fact, you...

HackerOne: HackerOne Integrations Design Issue

Summary HackerOne Integrations Design Issue Description Include Impact This bug is similar to 170552. The HackerOne Integrations feature is very sensitive and can not be used with just a click, IMHO, or we can say "HackerOne users are a click away from​ giving to an attacker very sensitive...

HackerOne: (HackerOne SSO-SAML) Login CSRF, Open Redirect, and Self-XSS Possible Exploitation

Summary: Login CSRF, Open Redirect, and Self-XSS Possible Exploitation through HackerOne SSO-SAML PoC - Go to █████; Use a browser window with clear cookies. Source-code: setTimeoutfunctiondocument.location.href = "https://hackerone.com/users/saml/signin?email=████&rememberme=true";, 5000; Impact...

HackerOne: Slack integration setup lacks CSRF protection

Details: Summary: Cross-site Request Forgery in the Integrations https://hackerone.com/YOURTEAM/integrations feature for teams. Description Include Impact: The Integrations flow is insecure, because it can be abused by CSRF. PoC: Request GET https://hackerone.com/auth/slack HTTP/1.1 Response...

RubyGems: Invalid username updating

Hello Rubygems, This is my first report on Hackerone, so please tell me if you need further information. This vulnerability/glitch uses the 'Edit Profile' page. How to do it: 1. Login to any account on Rubygems 2. Go to your profile 3. Go to 'Edit Profile' 4. In Handle, put the invalid username 5...

How I snooped into your private Slack messages [Slack Bug bounty worth $2,500]

When researching about MX records of slack.com, I noticed that they used a 3rd party email service. In that service, however slack.com was already claimed. After a little more research, I found that all the sub-domains of slack.com like teamname.slack.com also had MX set to the same service. Thes...

HackerOne: Ability to enumerate private programs using SAML

@ayoubfathi found a strong indicator of the existence of some private programs which were using SAML. Although it was not definitive, and we also warn teams using SAML that doing so removes their reasonable expectation of not being discoverable, we made some changes to help teams more easily...

Yelp Launches Public Bug Bounty

For a long time, Yelp.com has been one of the Internet’s most-frequented resources for crowd-sourced local business, restaurant and hospitality reviews and tips. Starting today, the door will be open to researchers and bug-hunters who are invited to participate in Yelp’s public bug bounty. The...

HackerOne: Users contents on AWS is cacheable

Hi , Background ============================= As I know you are using AWS S3 for saving and serving files . The AWS S3 on https://hackerone-attachments.s3.amazonaws.com are been called every time to show images on hackerone.com . For example view this report 145392 You will see a request for Fran...

HackerOne: Lack of length validation on user address attribute

Hi The input fields for adding mailing address for swag delivery in https://hackerone.com/settings/swags are not restricted in input lengths. I was able to add and read the contents via my own address page and the team pagewho awards the swag over 585728 characters in each of the input fields Nam...

HackerOne: Information leakage of private program

Hello team, I noticed an issue in Directory where information of a soft-launched program getting disclosed! I made this request as an unauthecated user, http GET /programs/search?query█████████&sort=publishedat%3Adescending&page=1 HTTP/1.1 Host: hackerone.com User-Agent: Mozilla/5.0 Windows NT...

HackerOne: Hacker.One Subdomain Takeover

Hello HackerOne Sec Team, Description : This report is about domain takeover of hacker.one via instapage 0day issue which i just found . Step To Verify : + Visit : https://www.hacker.one + You will see some html updated by me. Impact : + as its one of offical website of hackerone , so attacker ca...

Certly: Business logic Failure - Browser cache management and logout vulnerability in Certly

1.login the account. 2. browse any tabs or anything in the site 3. logout the account 4.click the back browser button and you are able to see the all previous page Related Topic: https://hackerone.com/reports/7909...

HackerOne: Non-secure requests are not automatically upgraded to HTTPS

Non-secure requests to hackerone.com e.g. http://hackerone.com are not automatically upgraded to HTTPS. This is not something you would notice when you use the latest version of modern web browsers such as Google Chrome or Firefox, because hackerone.com is HSTS preloaded. When a domain is...

HackerOne: Missing rate limit on critical user actions e.g. reset password, change email, disable account.

Hi I found that there are no rate limitations present on actions that require a password inside the account settings. Actions: Paypal email change Account email change Password Change Disable Account this will not be useful to attacker These sensitive actions require additional verification of...

HackerOne: Disclosure of external users invited to a specific report

It is possible to verify whether a specific user is invited to participate as an external user to a specific report. Thus it is possible to enumerate all external users added to a specific non-public report of interest. PoC: curl 'https://hackerone.com/reports/reportid/externalusers/userid' -X...

HackerOne: Repeated mediation requests and multiple emails possible on a report.

Hi, 1 We can by pass used buttom Confirm on Request Mediation from HackerOne where is disable him POC: Edit html and delete disabled="" And buttom in active. 2 Next catch request https://hackerone.com/reports/nubmerreport/hackerhelp POST: message=&mediationtype=resolution If parametr message null...

Kaspersky Lab Bug Bounty Program Launches

LAS VEGAS – Kaspersky Lab today at Black Hat USA 2016 announced the launch of a public bug bounty, one of the few offered by a software vendor in the computer security industry. The bounty begins tomorrow on the HackerOne platform, and the first phase will run for six months. The company said tha...