HackerOne · Report #293299
Validation message in Bounty award endpoint can be used to determine program balances
Summary
The finder found a vulnerability that allowed them to determine the available bounty balance of some programs. The endpoint that awards a bounty did a balance check before the authorization check and returned an error when the program had insufficient funds. Someone could iterate over all report IDs and try to award a number of bounties to narrow down the balance. The program names were only accessible for public programs. This vulnerability only affected a limited set of our customers.
We'd like to thank @cyriac and @cjlegacion for bringing this vulnerability to our attention!
How it was found
Summary: Hi team, Found a idor in Checking if a Team has sufficient fund to award
Steps To Reproduce
- Start a new program and login to the account
- A demo Report will be there
- Then Set award > Amount > $100
- Set award and intercept the request
- change the report_ids to #262262
#262262 - mixmax published report id
mixmax offers $100 minimum bounty
- And Request
we will get Validation failed: insufficient funds to award this bounty.*
again use this #208237 report id - LocalTapiola
we will get You have successfully awarded a bounty.
Using the report ids we get find that if funds have been added to teams or not
Impact
Just a information disclosure where we can check if team has added funds to the account