HexBrain

HackerOne · Report #2310620

New Hacktivity features:Bounty rewards leakage Where programs doesn’t decide to disclose bounty in limited disclosure report

Validstatus
mediumseverity
97upvotes
28 Mar 2024disclosed

How it was found

hello,

few months ago i submit #2030964 and sadly its closed as duplicate of this #1961639 , but i found to access same issue i.e: users hidden bounty information leak as new feature method that is bounty amount filter on hacktivity.

█████████

steps to reproduce

go to hacktivity page add filter - total_awarded_amount:10000 or total_awarded_amount:8000 you can see bounty awarded amount on report which is not visible as normal

i add some report please check

https://hackerone.com/reports/977212 https://hackerone.com/reports/881901 https://hackerone.com/reports/513236

now the feature to hide bounty amount is not worth here. please fix this so a non- authorized users, or no-one can see if hackers want hide bounty amount

Impact

due to new features hacktivity filter Anyone can seen total bounty award even hackers want to be hide from public

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original