LY Corporation · Report #1290170
Access to images and videos in drafts on LINE BLOG
Validstatus
mediumseverity
19upvotes
27 Dec 2021disclosed
Summary
On LINE BLOG, sequential ID is assigned to each image/video when uploaded, and the ID is converted to actual URL on preview/publish. Due to the bug in the attachment ownership verification process, it could be possible for an attacker to view unpublished images/videos in other users' drafts by modifying the attachment ID in the request sent to preview feature API.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.