HackerOne Undisclosed Report Leak via PoC of Full Disclosure on Hacktivity

How it was found

Summary:

Hi Team,

HackerOne is very sensitive when it comes to HackerOne report data such as report title,severity,program etc. H1 will not share those private data base on the HackerOne privacy policy.

Recently, HackerOne disclosed this report #1540969 Race condition in joining CTF group submitted by @zeyu2001 but the video PoC by the researcher was not redacted, the video contains undisclosed report reported by @zeyu2001 to other program like ██████ and ███ , this is both mistak by the researcher and HackerOne.

Researcher leak his own undisclosed report to PoC which is not related the #1540969 , and HackerOne did not redacted it before disclosure, resulting in disclosing sensitive information like report title.

Steps To Reproduce

1. Go to this fully disclosed report: https://hackerone.com/reports/1540969
2. Check this comment when report participant named @osman1337 completed the retest: https://hackerone.com/reports/1540969#activity-16794287
3. Observed that there is video PoC named poc-h1.mp4
4. Watch the video PoC carefully and 3 undisclosed reports unrelated to the submission was leaked on the video poc.
5. See screenshot below for my proof

█████████

The screenshot was taken from the video PoC, I can directly comment that the below undisclosed report was leaked

Report ID: #1570556 Report Title: ████ Severity: Medium Reported to: ████ (I believe this program is private because I can't see that in public directory)

Report ID: #1576582 Report Title: ██████████ Severity: Medium Reported to: ███████

Report ID: #1576582 Report Title: ██████ Severity: High Reported to: ████

Impact

Sensitive report data leak such as report title, severity. program, report id.

This is a clear violation of HackerOne data privacy for customers.

Mitigation:

Always review sensitive information before full disclosure to not disclosed other report data that was unrelated to the submission.

Let me know if you need more information.

Regards @syjane