Snapchat · Report #231460
Open prod Jenkins instance
Validstatus
highseverity
$15,000bounty
436upvotes
19 Aug 2017disclosed
Summary
@preben_ve found a Jenkins instance where they could login with any valid Google account.
Once logged in, they gained access to sensitive API tokens. The access also included some source code disclosure for public apps and the ability to execute arbitrary code via the Jenkins Script Console.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.