HackerOne · Report #2054222
Usernames still visible on report export pdf despite "I want to redact all usernames" is selected
Summary
During a period of roughly week we had deployed a feature that would let you redact usernames in the Export PDF function that did not account for a number of edge cases including nullability, short names, and a few other edge cases. The function did not perform what it was aiming to do, and was reverted thereafter, during that time the hacker identified one of such edge cases and filed the below report.
Write up:
https://medium.com/@robindivino/redacted-usernames-disclosure-in-export-as-pdf-feature-d00ce3f3e2fc
Video PoC: https://youtu.be/Sd18mVai_TM
How it was found
Summary:
Hi Team,
Export report via .pdf still disclosing the reporter username despite I exported it with "I want to redact all usernames" being selected to redact all the usernames.
{F2475645}
Steps To Reproduce
- Login and try to export any report using export as .pdf
- Select "I want to redact all usernames"
- Check the exported .pdf report is still disclosing the username of researcher
https://hackerone.com/reports/<REPORT-ID>.pdf?redact_usernames=true&pdf_type=reporter
PoC screenshot below:
█████
The .pdf looks messy (maybe design issue) but if you will take a look at Reported by: section at the report header, you will see: <REDACTED> (<REDACTED>j<REDACTED>a<REDACTED>p<REDACTED>z<REDACTED>) If you removed the <REDACTED> it will show the username japz.
If you removed all <REDACTED>, you will see something like the screenshot below:
█████
Impact
Information Disclosure