HexBrain

HackerOne · Report #1034257

Indexing of urls on the "External link warning" pages discloses many vulnerable endpoints from the past and unlisted videos/photos

Validstatus
mediumseverity
194upvotes
25 Mar 2021disclosed

Summary

@nagli found a misconfiguration in an interstitial page that could lead to a link to be indexed by a 3rd party. This could have exposed links to proof of concepts that HackerOne users had posted on hackerone.com. This affected a specific set of customers, which HackerOne worked together with to understand how the links could've been indexed in the first place. In most cases, this was due to browser plugins and email software. HackerOne addressed the problem by explicitly instructing crawlers not to index the interstitial page.

How it was found

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original