Public GitHub repositories for multiple HackerOne managed triage team profiles contain private HackerOne reports information

How it was found

Description

Hello, team! I hope this report finds you well. I identified a shared GitHub profile for the HackerOne-managed triage team at ███. It contains 44 public repositories, many of which were recently created: ██████████ Since this is a shared managed triage account, I thought that it could possibly be used to reproduce vulnerabilities for HackerOne-managed bug bounty programs. I did a quick look at the recent repos, and I discovered quite a few (active?) related to HackerOne bug bounty programs:

• ███/tester/blob/main/a.js looks like an exploitation script for IDOR at █████. ██████████ has a private h1-managed bug bounty program.
• By looking at the last commit in the █████ branch for ███████/edge-runtime, we can find a new file uploaded █████ with an exploit for access token, server URL, and secret leak for ██████'s edge runtime CLI tool ███████. ███ has a private h1-managed bug bounty program.
• Code execution in powertools for ██████████ lambda Java ████/clone-█████ by referring to an executable in the configuration file ‎pom.xml. ████ ██████ has a private h1-managed bug bounty program.
• ██████: secrets leak from GitHub actions by injecting a command to .github/workflows/pr-build.yml and creating PR █████. ██████████ has a private/public h1-managed bug bounty programs.

I also identified a few personal GitHub profiles for the HackerOne-managed triage ██████████. Here's a random report's commit: █████/setup-chain-node/commit/█████████ (and another fresh commit called "Retest," meaning the issue is potentially fixed), which is a GitHub actions injection into █████'s repository. I can't confirm if █████ has a HackerOne program, but it likely ████ is a fork of ██████████/dynamic-config for PR. The latest commit ████████ injects the preinstall command for package.json to execute script in github runner and leak secrets for ████████'s repository. ████████ has a managed HackerOne bug bounty █████: No public █████████: No public ██████. The GitHub token leak from GitHub actions for ███████ SDK for JavaScript is via ██████/█████████-sdk-js-duplicate/pull/2/files. █████████ █████ has a private h1-managed bug bounty ███ (now ████): Recent POC for █████ E2E encryption vulnerability ████/. ████ has a public h1-managed bug bounty ██████. Env vars leak from GitHub actions at ██████████/backstage/commit/███ for Backstage.

These are the only HackerOne-managed individual profiles I stumbled upon. I can try to bruteforce some more.

What is the expected correct behavior?

• Even if public repo creation is needed for vulnerability reproduction (for example, it's compulsory for GH actions leak), it should be deleted or changed to the private state.
• All HackerOne-managed triage team GitHub and GitLab profiles should be private to avoid additional info leaks.
• All HackerOne-managed triage team GitHub and GitLab profiles shouldn't have predictable usernames.

Impact

The indirect leak of active and fixed HackerOne private vulnerability reports, which were under HackerOne-managed examination by inspecting files in public repositories. As such, I identified vulnerabilities belonging to 9 private reports using a quick look. There are still many repositories to process, and more will be published in the future: the last public repo, at least for ████, was dated 5 days ago.

CVSS clarification:

• Confidentiality is High due to the leak of private HackerOne-managed reports. The number of leaked reports here doesn't represent the final number, as I haven't processed all the repositories. Additionally, the future publishing of reports should be considered.