HexBrain

Legal Robot · Report #180548

Missing restriction on string size in profile fields

Validstatus
mediumseverity
9upvotes
20 Jan 2017disclosed

Summary

Security researcher reported that there was no restriction on the amount of text that could be inserted into a user's profile field. The researcher also demonstrated that when the text size was large enough the service was restarted, resulting in a momentary outage in our non-production environment (not high-availability). An internal reproduction showed isolated disruption but no outage in our production environment.

How it was found

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original