$1,000 HackerOne Bounty | Viewing redacted username information
12#hackerone #bugbounty #informationsecurity
Researcher: https://hackerone.com/japz
Report:
https://hackerone.com/reports/2109009 (undisclosed - resolved)
https://hackerone.com/reports/2054222 (disclosed) - this is a reference report of #2109009, the vulnerability is similar, the undisclosed only shows bypassing fixes of the first/original report.
---------------------------------------
SUMMARY BY HACKERONE:
The hacker has reported vulnerabilities on this item in the past when it was .. more broken. We reverted it as the feature was neither secure nor functional. This is a follow up of https://hackerone.com/reports/2054222
In our second iteration of this feature, we put it behind a feature flag and invited the hacker to deliver direct feedback to improve the accuracy of the feature, the below report is the outcome of that. We're happy with where the feature is at now as a balance of security vs convenience.
JAPZ SUMMARY
I submitted 3 different root cause including the one that is recorded in the poc video, though the poc video seems to be doesn't have any impact, the other 2 root cause have impact that's why it was rewarded $1,000
1. username was disclosed when tagging participants using @username feature
2. username was disclosed on the internal data, like custom field etc.
3. username disclosed in reference (this is recorded in the poc video)
---------------------------------------
Please note that the email address disclosed in the PoC video is my test dummy email, that being said no sensitive info on the PoC video.