Internal attachments can be exported via "Export as .zip" feature

Summary

This issue was introduced on Monday, November 21st and resolved one week later on Monday, November 28th, within 90 minutes of the report being filed. We'd like to thank @japzdivino for bringing this to our attention and for working with us as we resolved the issue.

A new "Export as .zip" feature was released that permits teams to export the full contents of a report (including any internal comments and attachments). This is a useful feature for when a team needs to relay the full contents of a report to other colleagues who may not have access to HackerOne.

In this particular case, the vulnerability allowed for downloading internal attachments that would normally only be visible by team members. As part of our standard Root Cause Analysis, we also discovered that inline attachments could be misused to potentially view internal attachments at a future point based on guessing attachment identifiers.

HackerOne performed a thorough investigation of all uses of the "Export as .zip" functionality and have found no evidence of malicious exploitation of this vulnerability.

Note that although #182358 looks similar on the surface, it is unrelated, as it was fixed before this issue was introduced.

Here is my blog: https://medium.com/pinoywhitehat/security-teams-internal-attachments-can-be-exported-via-export-as-zip-feature-on-hackerone-35ca6ec2bf8b