Slack · Report #272578
Unauthenticated LFI revealing log information
Validstatus
highseverity
123upvotes
26 Jan 2018disclosed
Summary
@juji found a bug which allowed the disclosure of local files on certain servers - this included PHP files and logs. We performed a thorough investigation to ensure that this issue was not exploited, and as a precaution revoked tokens which were inadvertently logged. Thanks @juji!
Write-up incoming... Stay tuned on Twitter!
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.