Reflected XSS and possible SSRF/XXE on https://events.hackerone.com/conferences/get_recording_slides_xml.xml?url=myserver/xss.xml

Summary

@nagli found a reflected Cross-Site Scripting (XSS), Server-Side Request Forgery (SSRF), and XML External Entity (XXE) vulnerability in a 3rd party vendor that was used by HackerOne. This system did not contain any data related to reports submitted and stored on hackerone.com. HackerOne worked with the vendor to remediate the vulnerability. The report is partially disclosed to anonymize the vendor.

This vulnerability is part of a study I have been conducting about "Vulnerability inheritance - Attacking companies and scoring bounties through 3rd party integrations". events.hackerone.com was pointing towards a 3rd party vendor as a CNAME, I managed to find a full read SSRF and XXE vulnerability on an endpoint which belongs to the vendor via get_recording_slides_xml.xml?url= endpoint that allowed me to achieve Reflected XSS on Hackerone's subdomain.