IDOR on HackerOne Feedback Review
Timeline
Hi HackerOne Team,
Summary:
I have found an IDOR on HackerOne feedback review functionality, below are the following issues.
-
Security teams can create public feedback to the hacker which is did not submit any report to them, please note that public feedback will be seen on hackers profile.
-
Information Disclosure, the hacker will be able to see the private feedback and the report title that will be sent to his email even that is not his report title.
Lets focus on the first one which have direct security risk to all hackers, because it can be used to downgrade their profile reputations using the "What Programs Say"
Description (Include impact):
A malicious user can create a public review to any hackers that he wants using the IDOR on hacker review functionality, the public review will be displayed on the hackers profile, therefor if the malicious person creates a disgusting review, all hackerone users can see that on victims user profile "What Programs Say", and may downgrade the users profile reputation.
Steps to reproduce:
Please note that i ask permission to the following persons below, before i reproduce my findings:
-
@phspade a bug hunting buddy and a close friend of mine from Parrot Sec (who is the PH ambassador of Parrot Security OS and one of the sec team member who handle reports on Parrot Sec program)
-
@jong_jong my other half <3
Lets proceed to the steps to reproduce:
- I used @jong_jong accounts to submit test report to Parrot Sec program.
- @phspade closed my test report then i ask him to review me and give him some instruction to perfrom an IDOR.
- @phspade click the review button and put the below necessary info: Selected
Friendlinessradio button, Public feedback:Japz is awesome :), Private feedback:Thanks for your report. - Submit the report and capture the request, on POST /hacker_reviews HTTP/1.1 you will see this parameters with it's values
hacker_username=jong_jong&report_id=<redacted>&positive=true&behavior=friendly&private_feedback=Thanks+for+your+report. - The vulnerable param is the hacker_username , change the value to victims username. (e.g
hacker_username=japzdivino) and forward the request.
japzdivino will received an email notification regarding the review, but it should be jong_jong should be the one to received
Also japz profile will display the public review, instead of jong_jong's profile.
Let me know if anything else is needed.
Regards
Japz
2 attachments
posted a comment.
Hi @rockyrobot ,
I'm sure there is already a fixed on this, i cannot reproduce the issue now, but here is my proof video after my initial submission! , I have saved this on my local.
█████
On my PoC video i (japzdivino) submitted report to parrot, then the review was posted to jong_jong's profile using the IDOR bug!
Please watch the video proof, I created that video after i submit my report, but haven't uploaded yet because i am sleepy, i am planning to upload but i saw your comment and i try to reproduce the issue trying to post feedback on your profile but it seems the issue has been fixed now.
Please confirm that you guys implemented a fix.
Regards
Japz
posted a comment.
Hi @rockyrobot ,
My apologies, i got it now.. the issue not yet fix, i am a little confused but now i have the full reproduction steps, i perform a little investigation on the end point and i have found that there is a little precondition to successfully performed an IDOR, the precondition is the user needs to become a participants of the program.
The reason why i cannot post on your profile because you are not participant on parrot sec program.
NOTE 1: precondition is the victims needs to be participants, so to be able for me to perform an IDOR posting a feedback on your profile, can you submit a test report on https://hackerone.com/parrot_sec ? , I already ask permission to my friend @phspade.
NOTE 2: I will not going to touch your test report, means it is a
New status, your test report will not be closed, you just need to be participants :) , i will perform an IDOR using other closed reports without touching your report.Let me know if this is ok with you.
Other option for you to reproduce is, you will review any report from hackerone, and since i (japzdivino) is a participants on hackerone program, you can post a feedback to my profile using the steps on my initial submssion, just change the value of vuln param (e.g hacker_username=japzdivino)
Example:
- Lets say jobert submitted a test report
- rockyrobot closed jobert's test report
- rockyrobot will review/feedback jobert's test report
- capture the request and change
hacker_username=joberttohacker_username=japzdivino - IDOR will successfully perform because victims (japzdivino) is a participants on HackerOne.
Let me know if you need more info.
Regards
Japz
HackerOne staff
changed the status to Needs more info. Hi @japzdivino, thanks for bringing this to our attention! Here is what's happening: the endpoint takes both a username and a report ID. It first looks up if there's already a review for that particular report. If not, it'll see if you're authorized to write a review for that report. Then, it'll do a separate query to see if you can write a review for the user. This isn't tied to the report, so you are able to write a review for someone that didn't submit the report. However, the user still needs to have submitted a report to ANY of the programs you manage (verified programs). Even though it's an odd way of checking whether you can review the user, I wouldn't say it's a vulnerability. The title is disclosed in the email, but if a team member wants to send the report title to someone, they can already do that. It sounds like this turns out not to be a security vulnerability. Perhaps I'm missing something, so please let me know what you think. Thanks!
changed the status to New.
Hi @jobert ,
Thanks for your response.
I think the wrong thing is on this part:
Then, it'll do a separate query to see if you can write a review for the user. This isn't tied to the report, so you are able to write a review for someone that didn't submit the report.
The review/feedback is for the hackers who submitted that report (when the report is already closed), but the wrong thing is, i can re-route the feedback to the hacker (participants/victim) but the victims report was not yet touched by the team, means the status is still
New , the review is the overall interaction to the hackers, so it is wrong to allow to review the hackers who's report was not yet touched by the sec team. It is a clear IDOR.Even though it's an odd way of checking whether you can review the user, I wouldn't say it's a vulnerability.
I have to disagree a bit on this, because there is a direct impact to all program participants, either good or bad reputations using the "What Program Say".
Imagine that i can create a public review to the hackers who do not have resolved reports yet on a program.
The title is disclosed in the email, but if a team member wants to send the report title to someone, they can already do that. It sounds like this turns out not to be a security vulnerability.
I agree on this, that is why I focused on the first scenario which have direct security risk to all hackers which is participating to any program (participants).
I think you have to revisit the separate query that checks if you can write a review for the user
Let me know if you need more info.
Regards
Japz
posted a comment.
And according to the first paragraph of this: https://support.hackerone.com/hc/en-us/articles/115003573643-Hacker-Reviews
With Hacker Reviews, HackerOne customers have the option to send comments on hacker behavior to HackerOne and the hacker after closing a report.
But as you can see with the bug i submitted, i was able to comment/review on a hacker behavior without touching his/her
New report.Regards
Japz
changed the status to Triaged.
Hi @japzdivino - We've determined that this is something we want to fix. I'm triaging this now. I will let you know when we have more info to share. Thanks again for your report!
posted a comment.
Thanks for triaging @coffeecup, I'm glad i was able to help.
closed the report and changed the status to Resolved.
Thanks for reporting this! This is now resolved.
has decided that this report is not eligible for a bounty.
reopened this report.
We've determined that this is not eligible for a bounty, but we will be sending some swag :)
closed the report and changed the status to Resolved.
posted a comment.
Hello @coffeecup @security
We've determined that this is not eligible for a bounty, but we will be sending some swag :)
First thank you so much for the swag, This is so much appreciated.
However, may i know the reason why this does not qualify for the bounty ? , i was wondering because the the assets is the main domain/application which is indeed critical for hackerone, and the IDOR affects many users.
I'd appreciate if you can further explain the reasons for not qualifying my report for the bounty.
Regards
Japz
posted a comment.
Hi @japzdivino - I'd be more than happy to explain the reasoning behind this. There was no security risk because we found that programs could only leave feedback for hackers who are already on their program. This eliminated the cross-team feedback IDOR threat that was the original concern. We decided to put a fix in place to avoid potential security vulnerabilities in the future.
We really appreciate your report and hope that you'll report more to us in the future. Thanks for thinking of HackerOne security and enjoy the swag!
posted a comment.
Hello @coffeecup ,
Thanks for your response, I understand and i always respect sec teams evaluation.
Thanks for thinking of HackerOne security and enjoy the swag!
Yup, the swag is very much appreciated :)
BTW, i created a blog , here is the draft, mind checking if that is good to go public ?
Regards
Japz
updated the severity from high to
low (3.4)
. 
requested to disclose this report.
Hey @japzdivino - We have adjusted the severity on this submission. That said, we'd appreciate it if you do the same on your blogpost as well. We have also initiated the swag process, so it should be on its way soon!
Thanks again!
has decided that this report is not eligible for a bounty.
invited another hacker as a collaborator.
joined this report as a collaborator.
agreed to disclose this report.
Hello @nahamsec ,
We have adjusted the severity on this submission. That said, we'd appreciate it if you do the same on your blogpost as well.
Agreed because the issue have 2 preconditions to successfully exploit, I've already adjusted the blog post, here is the public: https://medium.com/@japzdivino/idor-on-hackerone-hacker-review-what-program-say-885ce3989a6f
We have also initiated the swag process, so it should be on its way soon!
Thank you very much :) , I'll be sharing some of my swag to my other half @jong_jong so i added her on the thread as a collaborator, looping her in the thread was also a part of my testing on the new feature of hackerone here.
Regards
Japz
This report has been disclosed.
invited another hacker as a collaborator.
invited another hacker as a collaborator.
joined this report as a collaborator.
