HackerOne: Improve signals in reputation

New section has been added recently in reputation where you can see something called as signal , which says average reputation per report. However, you can improve your signal points by following below steps Steps: create any report in any team self close the bug see your signal in reputation. it...

HackerOne: Team Member███ associated with a Custom Group Created with 'Program Managment' only permissions can Comments on Bug Reports

Hi Team, Legend ====== AppSecBounty = Bug ProgramSandbox Program Hacker1001 = Bug Reporter BugAdmin = Program Admin BugMember = Team Member associated ProgramManagement Group ProgramManagement Group = Custom Group created with "Program Management Permission" Steps: 1. Hacker1001 reports a Bug to...

ownCloud: owncloud.com: Parameter pollution in social sharing buttons

Hello Owncloud ! For Example , We Have a Link : https://owncloud.com/blog-you-can-soon-be-fined/ And We Change It To :- https://owncloud.com/blog-you-can-soon-be-fined/?u=https://vk.com&text=anothersite:https://hackerone.com/gorangjoshi So When You Share It , While Using Your Sharing Buttons...

HackerOne: Parameter pollution in social sharing buttons

Hello! For example we have a link https://hackerone.com/blog/introducing-signal-and-impact, and we will change it to https://hackerone.com/blog/introducing-signal-and-impact?&u=https://vk.com/durov. If you send a link to the user and he wants to share a link to facebook, the content will change...

HackerOne: Know whether private program for company exist or not

HI, There are some company which are hosting private BB on HackerOne which are not visible unless they invite you. However, you can check if any company is hosting private BB on HackerOne or not if you can guess the username they use. Generally most company chooses the same name as their company...

Coinbase: XXE in OAuth2 Applications gallery profile App logo

upload svg photo XML based as App logo contain XML payload renamed to .jpg server start execute this XML payload or just watch this video "https://www.dropbox.com/s/wkba6f0wrax0wr8/xxe.mp4?dl=0" the same vulnerability was in https://www.coinbase.com/careers and reported by...

HackerOne: CSRF possible when SOP Bypass/UXSS is available

Description If an attacker could extract content from https://hackerone.com, they could perform CSRF attacks due to the fact that: 1. Some pages prints the token in the HTML response edit user form at https://hackerone.com/settings/profile/edit 2. Tokens aren't bound per action 3. PATCH/DELETE ca...

HackerOne: Pre-generation of 2FA secret/backup codes seems like an unnecessary risk

If you manage to get a malicious script running in HackerOne, requesting https://hackerone.com/settings/authentication/edit and parsing out the two factor authentication form will yield either… - the 2FA secret key and backup codes that will be used if 2FA is enabled for the first time this sessi...

HackerOne: profile cover can also load external URL's

Hi, I have to option to change my cover background https://hackerone.com/programname/edit. When I insert 360e0e url'http://www.google.com' as background "color" it will make a connection to http://www.google.com If IE is used. I can't save it so it won't affect any other people but it doesn't loo...

HackerOne: Hackerone impersonation

You should restrict users to create user profile named "hacker0x01" because it represents 'hackerone' everywhere. Any user can create a profile named "hacker0x01" although he/she is a completely different user. This way user can potentially impersonate hackerone...

HackerOne: Send AJAX request to external domain

Hello! I would like to report about ability to send AJAX request from hackerone.com to external domain. Here is PoC for the last version of Internet Explorer: https://hackerone.com/bugs?subject=%2Fbigbob.lv%2F1337.php%3Fdata%3D If You visit it, You can see Hello! This is custom text from external...

Content Injection via TileJSON attribute

Overview Versions 1.x prior to 1.6.5 and 2.x prior to 2.1.7 of mapbox.js are vulnerable to a cross-site-scripting attack in certain uncommon usage scenarios. If L.mapbox.map or L.mapbox.tileLayer are used to load untrusted TileJSON content from a non-Mapbox URL, it is possible for a malicious use...

HackerOne: Minimum bounty of a private program is visible for users that were removed from the program

Hello, Privileged information is getting leaked to an unauthorized user in the json response of https://hackerone.com/reports/.json. In a team there can be many members, also roles are defined. But an x-member of the team is getting information which should not be visible to him. As I tested it o...

HackerOne: HackerOne Private Programs users disclosure and de-anonymous-ize

Hi HackerOne Team, I have found a bug in HackerOne Platform allows any attacker to deanonymousize any security researcher using the platform and the most wild usage is to disclose some information about this security researcher if he is invited to a private program or not. Unfortunately HackerOne...

HackerOne: Content spoofing on invitations page

When you are an owner of a program on h1 , you are allowed to invite external users to access any report through email . As you invite someone , this is how the body of invitation is being sent through email :- link to researcher's profile invited you to join the bug Title Of The Bug for Name of...

VK.com: Уязвимость дает возможность смотреть кто лайкал приватным фото или видео

Отсутствие необходимых проверок при получении списка отметок "Мне нравится". similar report received more bounty - https://hackerone.com/reports/64754 - 300$ ███████████████████████████ ███████▀▀▀░░░░░░░▀▀▀███████ ████▀░░░░░░░░░░░░░░░░░▀████ ███│░░░░░░░░░░░░░░░░░░░│███ ██▌│░░░░░░░░░░░░░░░░░░░│▐██...

HackerOne: Minor Bug: Public un-compiled CSS with original sass, versioning, source map, comments, etc.

A stylesheet is available in a non-minified, non-compiled format. It includes sass, versioning, a source map, a style guide, comments, etc. see base64 encoded string at the very end of the document. https://hackerone.com/assets/application.css This alone is obviously not an exploit. However, it c...

HackerOne: Weak HSTS age in support hackerone site

Send this request: GET https://support.hackerone.com HTTP/1.1 Connection: keep-alive Accept: application/json, text/javascript, /; q=0.01 X-Requested-With: XMLHttpRequest Content-Length: 0 User-Agent: Jakarta Commons-HttpClient/3.1 Host: support.hackerone.com Response header: HTTP/1.1 200 OK...

HackerOne: Internal bounty and swag details disclosed as part of JSON response

Hello Hackerone team !!!! If Some company take option like this : Show minimum bounty on the program page? Do not display the minimum bounty on the program page. for example : https://hackerone.com/███████████ Private bounty details "basebounty":10 https://hackerone.com/████ Private swag details...

HackerOne: Number of invited researchers disclosed as part of JSON search response

I was informed via email that the bug I tweeted about https://twitter.com/jessescitech/status/623976563177070594 is actually a security issue, and the number of search results returned is the number of invited researchers for the team. I can't actually verify this, but the email said that a fix i...