Slack: Real Time Error Logs Through Debug Information

Summary: During the assessment, I have found the debug URL on slackb.com which is disclosing the World Wide real time error logs of Slack users. The information leaked includes the following: 1. User Device Information 2. Redacted Token 3. Client IP Address 4. Description 5. Session ID 6. Team ID...

Video: HackerOne CEO on the Evolving Bug Bounty Landscape

The bug bounty landscape continues to change along with the concept and rules around vulnerability disclosure. Meanwhile, companies such as GitHub, Microsoft and others continue to keep pace, launching or expanding bounty programs. Even the European Commission is getting in on the action. On...

HackerOne: DOM Based XSS in www.hackerone.com via PostMessage (bypass of #398054)

Summary The security fix by Marketo to resolve the issue reported by @adac95 in 398054 can be bypassed by purchasing an .ma domain for €60. Description The issues described by @adac95 in 398054 remain insufficiently resolved because of an inadequate security check by Marketo in the following piec...

Prototype Pollution

Overview Versions of lodash before 4.17.5 are vulnerable to prototype pollution. The vulnerable functions are 'defaultsDeep', 'merge', and 'mergeWith' which allow a malicious user to modify the prototype of Object via constructor: prototype: ... causing the addition or modification of an existing...

HackerOne: report id is exposed for undisclosed reports in Hacktivity

Summary: This is similar to https://hackerone.com/reports/127620 where the report Id of undisclosed report is visible on graphql query Description: The new hacktivity graphql query includes undisclosed reports, but part of the query result is the report id which is included in private information...

Prototype Pollution

Overview Versions of node.extend before 1.1.7 or 2.0.1 are vulnerable to prototype pollution. Recommendation Update to version 1.1.7, 2.0.1 or later. References - HackerOne Report - GitHub Advisory...

HackerOne: Confidential data of users and limited metadata of programs and reports accessible via GraphQL

Summary: The GraphQL endpoint doesn't have access controls implemented properly. Description: Any attacker can get personally identifiable information of users of Hackerone such as email address, backup hash codes, facebookuserid, accountrecoveryphonenumberverifiedat, totpenabled, etc. These are...

HackerOne: Race condition in claiming program credentials

Hi, Summary: I was invited to a private program and I tried to get test credentials so a request as follows was sent to your server: POST /graphql HTTP/1.1 Host: hackerone.com Connection: close Content-Length: 778 Accept: / X-Auth-Token: ████ User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64...

HackerOne: Disclosure of h1 challenges name through the calendar

Summary: It seems like the Calendar somehow grabs the name of the target for a h1 challenge even though the target name is not public. Description: h1challenges do not disclose the name of the target until the time it starts. For example for this challenge: █████ the name of the target is not...

RATELIMITED: Missing Protection Mechanism in Mail Servers allows malicious user to use staff.ratelimited.me email could lead to identity theft.

Hello ratelimited, I'm not really sure how your mail servers being configured but i guess there is a mis-configuration or missing protection mechanism that fails to verify if the email that is going to be sent are only made by authorized ratelimited staff only. From this point of view a malicious...

Path Traversal

Overview Versions of http-live-simulator prior to 1.0.7 are vulnerable to Path Traversal. Due to insufficient input sanitization, attackers can access server files by using relative paths. For example: curl --path-as-is http://localhost:8080//../../../../etc/passwd. Recommendation Upgrade to...

Chrome: CVE-2019-5765: 1-click HackerOne account takeover on all Android devices

████████████...

HackerOne: Response program can display "eligible for bounty" in scope area in program policy

Hello Hackerone Team and @jobert First of all, Happy new year to everyone. Summary Response program can also display "eligible for bounty" assets on program policy. It's basically causing from backend in terms of GRAPHQL mutation query for eligible in bounty:true which stays forever on response...

Ox App Suite 7.8.4 / 7.8.3 XSS / CSRF / Information Disclosure

Dear subscribers, we're sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those vulnerabilities. Feel free to join our bug bounty programs open-xchange, dovecot, powerdns at HackerOne. Yours sincerely, Martin Heiland, Open-Xchange GmbH Product:...

HackerOne: Cross-site Scripting (XSS) on HackerOne careers page

Dear HackerOne team, Summary: I found DOM XSS at endpoint https://www.hackerone.com/careers, but can not bypass CSP. It's work on IE and Edge. Steps To Reproduce - JS file is "Masonry js file", vulnerability code: javascript //Checking for potential Lever source or origin parameters var pageUrl =...

HackerOne: Submitting report through Embedded Submission form gives user indefinite access to a profile

Summary: Hi team, @jobert , @ben After testing on the sandbox, I noticed that one of my accountswhich I removed from the program can see some of the information. I don't know if it affects other programs that have other States - private-only, private-only whit external link. I could not find the...

Grammarly Launches Public Bug Bounty Program

Online AI-based communications tool Grammarly is taking its private bug bounty program public in hopes of finding and fixing more vulnerabilities in its software. The company has run a private bug bounty program – which currently has 1,500 participants – in conjunction with HackerOne for over a...

HackerOne: Response program can create bounty table

Summary: Follow h1 document https://docs.hackerone.com/programs/bounty-tables.htmlgatsby, create bounty table only available for bounty program. Description: Step1: Create request to graphql entrypoint Step2: Change team id in parameter like this: "teamid":"Z2lkOi8vaGFja2Vyb25lL1RlYW0vMzYyOTE="...

HackerOne: GitHub users outside of HackerOne organization can create and update Wiki pages of certain public HackerOne repositories

Summary Hi HackerOne team, recently this vulnerability have been reported and resolved in various programs, so I'm going to try my bad luck, reporting the same kind of report also in this program. Steps 1. Go on https://github.com/Hacker0x01/react-datepicker/wiki/BB-test 2. I've created a simple...

Path Traversal

Overview All versions of simplehttpserver are vulnerable to Path Traversal. This vulnerability allows an attacker to access files outside the webroot since it allows symlink navigation in the URL. Recommendation No fix is currently available. Do not use simplehttpserver in production or consider...