HackerOne: Changing the 2FA secret key and backup codes without knowing the 2FA OTP

Summary: After the setup of 2FA, disabling or editing it should require the 2FA OTP. But it can be bypassed. Steps To Reproduce: 1 Sign in to a new HackerOne account. 2 Setup 2FA; and 3 Try to disable it without knowing the OTP. You can't, you need to know the Authentication Code or Backup Code...

HackerOne: Editing Pentest Summary Report Answers After Submitting Them

Summary: Pentest leads should not be able to edit pentest summary report answers after submitting them. Steps To Reproduce: 1 After submitting the pentest summary report, try to edit it: F1246327 You can't. The form is disabled. 2 Use the HTTP Request below update X-Auth-Token, Cookie and the...

HackerOne: Bypassing the External Link Warning

Summary: As the HackerOne team is aware, the URL https://hackerone.com/users/saml/[email protected] can redirect users to external pages. Because of this, there is a protection in the links created by Markdown to show the user a warning when clicking in any link started with...

HackerOne: The possibility of disrupting the normal operation of frontend using markdown

Summary: Hi team, Our team noticed that using some string construction in markdown may cause it to fail and output error 502. Thus, disrupting the UI process. This may affect the work in places where there is a GraphQL attribute output. For example: User object in GraphQL : introhtml attribute...

HackerOne: Hackerone is not properly deleting user id

Summary: Long ago, i had an account on hackerone that is now deleted. I used the alias email provided by h1 to sigbup on a site for bug testing. To my surprise, i receive an email to my account routed from an alias email that should not exist. Description: Steps To Reproduce 1. SignUp on H1 2. Us...

HackerOne: Attachment object in GraphQL continues to grant access to files, even if they are removed from rendering

Summary: Hi team, Our team noticed that youprogram can attach files to the policy page. These files can be anything, images, text, archive, etc.In other words, these files may or may not contain sensitive information. Our team believes that the data that can be attached in different vectors is hi...

HackerOne: Race condition allows to send multiple times feedback for the hacker

Summary: Hello team! We've found out that the program's should be able to send feedback only once per report which is very logical. However, the program user is able to send multiple parallels requests which will lead to the race condition situation and will send multiple feedback to the hacker...

HackerOne: CSV injection in the credentials export

Summary: Hello team! We have found out that a hacker can inject malicious excel formulas into the credentials details which will be executed when program user exports the credentials details via https://hackerone.com/hackeroneh1pbbp3/credentials - export credentials and opens this CSV using MS...

HackerOne: CSRF allows to test email forwarding

Summary: It is possible to send email forwarding emails in the name of victim. The main problem is that you don't verify the X-CSRF-Token in the endpoint /securityemailforwarding/testforwarding.json?id=$id. Steps To Reproduce: - Login as an program user who has access to the Email Forwarding -...

HackerOne: User's who are banned from program can still be invited to the new reports as collaborators

Summary: Hello team! We have found out that the banned user's who are banned from program can be invited to the new reports as collaborator users. This is pretty weird because the hacker should be banned and no new reports shouldn't be allowed. If program bans the hacker the program can't invite...

HackerOne: Hackers can reveal the names of private programs that have an external link and Enterprise Product Edition

Summary: Hi team, A few days ago, your engineers revealed a field in the report- Custom fields. The team removed it after a while, but did not remove the design line Custom fields Available only for Enterprise Product Edition , Therefore, the sandbox program cannot independently accept this versi...

HackerOne: Hackers can find out the ID of private programs

Summary: Hi team, Our team noticed that it is possible to find out the IDs of sandbox programs. This allows us to create a list, thereby determining that the rest of the list of IDs will belong to private programs or public or external programdirectory listing. But by removing ID all public and...

HackerOne: Lack warning label when receiving a letter

Summary: Hi team, When using the function ShareReportViaEmail the email is sent to the email address specified by the hacker.This email looks legitimate and comes from verification email addresses, leaving no doubt about it being replaced. This endpoint also applies to sandbox reports which makes...

HackerOne: Used email confirmation link reveals the email address which is tied to it

Summary: If an attacker finds an used email confirmation link the token is in URL s/he will be able to see the email address which is tied to the confirmation link ID. The attack itself is pretty unlikely but the application should show the generic error message like The confirmation ID is invali...

HackerOne: Hackers can reveal the names of private programs that have an external link

Summary: Hi team, Our team has found a way to distinguish between private programs with external links. Due to the ability to select Severity Rating Options, the program can set two options : Rating or CVSS Score and CVSS Score Only. One of them removes the possibility of setting the...

ExpressionEngine 6.0.2 PHP Code Injection

---------------------------------------------------------------------------- ExpressionEngine security-sanitizefilename$file; 366. 367. $destdir = $this-languagesdir . $language . '/'; 368. $filename = $file . 'lang.php'; 369. $destloc = $destdir . $filename; 370. 371. $str = 'lang-loadfile$file;...

HackerOne: HackerOne Jira integration plugin Leaked JWT to unauthorized jira users

Summary: HackerOne provides an application tool HackerOne for Jira, an application that allows programs to track security issues through a jira instance. After testing the integration feature in the application, it was found that the application leads to the leakage of the JWT to unauthorized...

Concrete CMS: Authenticated path traversal to RCE

crayons Description The bFilename parameter in the scenario index.php/ccm/system/dialogs/block/design/submit is vulnerable to remote code execution via path traversal vulnerability. Authenticated attacker with rights to edit web application pages can upload malicious PNG file containing PHP code...

Top 5 Bug Bounty Platforms to Watch in 2021

While Gartner does not have a dedicated Magic Quadrant for Bug Bounties or Crowd Security Testing yet, Gartner Peer Insights already lists 24 vendors in the "Application Crowdtesting Services" category. We have compiled the top 5 most promising bug bounty platforms for those of you who are lookin...

Top 5 Bug Bounty Platforms to Watch in 2021

While Gartner does not have a dedicated Magic Quadrant for Bug Bounties or Crowd Security Testing yet, Gartner Peer Insights already lists 24 vendors in the "Application Crowdtesting Services" category. We have compiled the top 5 most promising bug bounty platforms for those of you who are lookin...