HackerOne · Report #123027
Edit Auto Response Messages
Validstatus
$1,000bounty
4upvotes
15 Mar 2016disclosed
Summary
Given
- a team with an autoresponse comment set up
- a user submitting a report to said team
Then
- the submitter was able to edit the team's auto-response comment until the edit period timed out.
This was due to the way that permission checks were handled when the commenter was a User versus a Team. This was a recent regression due to a change introduced on 03/11/2016.
How it was found
Not completely sure if this is by design due to encountering it for the first time.
When a company has auto response turned on, the reporter can change the contents of the message without any problems.
The reporter should not be able to change the contents of the companies auto response in any way due to the fact that they should not have privileges to that feature.
PoC: Users can abuse this by changing the contents of the auto response to something else.