HackerOne · Report #156948
Repeated mediation requests and multiple emails possible on a report.
Summary
This was essentially the same issue as what was disclosed in #159512. We however failed to recognize it and merge the two reports as duplicates, which is why we decided to reconsider the reward here.
The original report only described a way to repeat requests and send multiple emails. We do not consider this to be a security issue. However, later on @haxta4ok00 identifies it is possible to request mediation on reports that were too old to mediate, which is the same as what was reported in #159512. This has a very minor security implication, which prompted us to reconsider our response here.
We originally posted in #159512:
@troubleshooter identified a discrepancy between our frontend and backend validation. While our frontend did not allow hackers to request mediation on reports that were too old to mediate, a forged request would still be accepted by our backend due to different validation rules. While this has minor security implications, we decided to make the validations consistent and award our minimum bounty of $500 here.
How it was found
Hi,
- We can by pass used buttom Confirm on Request Mediation from HackerOne where is disable him
POC: Edit html and delete disabled="" <input type="submit" data-reactid=".8.0.1.0.6.1" disabled="" class="button button--success button--modal pull-right" value="Confirm">
<input type="submit" data-reactid=".8.0.1.0.6.1" class="button button--success button--modal pull-right" value="Confirm">And buttom in active.
- Next catch request https://hackerone.com/reports/nubmerreport/hacker_help POST: message=&mediation_type=resolution
If parametr message null , we can send multiple requests. And spamming support But if message is no null we have 404
PS Yes you page is write Spamming other users with automated HackerOne emails or notifications (e.g. abusing the forgot password form). But this problem is multiple requests.
thx,, sorry bad eng.