HexBrain

HackerOne · Report #2263294

Cloud Computer Hackerone Triager can be Accessible for everyone [[email protected]] computer

Informativestatus
91upvotes
10 May 2024disclosed

How it was found

==This report was reported to program #2262768 at the request of h1_analyst_shiva I re-reported it here==

hello dear

I don't know if I should send this report to HackerOne or to █████████

Although this is not a bug, but obviously a forgetfulness, but the impact will be very bad and great if the computer contains important and sensitive data and information that can be easily controlled by hackers and researchers and hacked be done

I've been working on ████████ for a long time. Today I saw that the computer of one of the Triagers is online while we have a big time difference with Europe and the United States, so I was surprised to see this in this section

██████ RS1FIMUNSRVJGVFZLTl84NiIsImV2ZW50U3RhcnRUaW1lIjoxNzAwNzg0MTYyMzg1LCJoaWVyYXJjaHkiOiJzcmMiLCJvcmlnaW5Qcm9jZXNzU3RhcnRUaW1lIjoxNzAwNzg0MTYyMzIxLCJv cmlnaW5Qcm9jZXNzVW5pcXVlSWQiOiI1Rjk1QzJDNDY0RESERBRKRFIiwicHJvY2Vzc0deep3VwSWQiOiIxNTg4QjhDNDY0RESERBRKRFIn0%3D

When I went to the [email protected] site table, I saw that it was still online and you could use the remote shell to log in to the computer

{F2881374}

Note that I have not used any commands except these to verify my report

ls
cd ..
cd  Users
ls
done

████████

In ████, it's normal for all users to see other people's computers, but I don't think it's normal for Hackerone staff and Triager

███

Impact

Cloud Computer Hackerone Triager can be Accessible for everyone

Impact

Cloud Computer Hackerone Triager can be Accessible for everyone

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original