Harvesting all private invites using leave program fast-tracked invitation and security@ email forwarding feature

How it was found

Hi HackerOne,

Summary:

I have found a way that it is possible to harvest all private invitation using the new Leave Program feature together with the security@ email forwarding feature without any user interaction.

Description:

First, when the program activated the security@ email forwarding on hackerone and the hacker sent an email to [email protected] which is activated, hackerone system will send an invite to hackers and this invite will allow hackerone to become a participants of private program.

Now, hackers can choose to leave to the program in exchange of another automated invite when the hackers filled-up the leave program survey form using the new Leave Program functionality. (see image below)

{F282541}

Now how to exploit it ? , very easy.. hackerone will do it for you fully automated without any user interaction

Steps To Reproduce

Assumes that you don't have any invites (as in 0 invites)

1. First step you have to find program with security@ email forwarding enabled on hackerone, this is easy just go to https://hackerone.com/bug-bounty-programs, click all the program and send a test email to their declared security at email on their public page, if you received a response to submit your bug, then that means security@ is activated in hackerone.
   ███████

2. Lets take ███████, send a test mail to that address

3. You will received an invitation email via security@ email forwarding feature.

4. Click the Submit Vulnerability , you are now a participants.

5. Now leave the program and fill-up the leave survey then confirm leave.

6. You'll be fast-tracked for invites, invitation will come most likely arriving in the next 24 hours as stated.

7. REPEAT STEP 2 to 7 after getting a new invite came from fast-tracked invites.

NOTE: Ask more information if you are having trouble understanding my submission.__

But this is easy to exploit, just send an email to: ██████ > get invites > leave to ██████████ > get new invites came from fast-tracked > repeat

Impact

An attacker can harvest all private invitation without any user interaction, in a matter of few months you can have 100+ private invitation by just daily repeating the steps i provided above.

INVITES ALL YOU CAN

Let me know if you need more information.

Cheers Japz