HackerOne · Report #109420
Requesting unknown file type returns Ruby object w/ address
Validstatus
2upvotes
19 Feb 2016disclosed
How it was found
Hello sec folks,
requesting a report you are not allowed to acccess along with an unhandled filetype extension discloses a Mime::NullType Ruby object representation with a corresponding memory address.
Example: https://hackerone.com/reports/1337.foo
Request:
GET /reports/1337.foo HTTP/1.1
Host: hackerone.com
Response:
HTTP/1.1 401 Unauthorized
....
Content-Type: #<Mime::NullType:0x007f3588fe32c8>; charset=utf-8
...
Cheers!