Exposing hackerone users personally identifiable information by abusing sandbox with swag reward enabled

How it was found

Hi HackerOne Team,

Summary:

I have found a critical bug but this will require a bit user interaction, BUT please take note that once exploited, a hackerone user's PII - personally identifiable information can be exposed. I have found this bug by using the sandbox with swag reward enabled .

Let me explain first on how this work, basically when the program reward a swag to a hacker, all the hacker swag information here: https://hackerone.com/settings/swags will be send to the program owner for proper shipping etc. and can be seen on this end point: https://hackerone.com/<program_handle>/swag

Now i have found a way to use that to expose a Co-hackers PII listed below:

• Complete Name
• Street
• City
• State/Province
• Postal Code
• Country
• Phone Number

The question is how ? , please see below steps.

Steps To Reproduce

1. Create a sandbox program and enable the swag rewarding On
2. Now add any team member, base on my experience most hackers are interested to collaborate when you add them to the sandbox.
3. New team member will most likely play with the sandbox like Creating test report, closing reports, rewarding etc.
4. NOW THIS IS THE BUG, when the hackers invited to the sandbox, and then they created a test report, the program owner can reward a swag and then expose their PII, because the sandbox program owner can see all of the swag information here: https://hackerone.com/<program_handle>/swag

LIVE EXPLOITATION

I invited a co-hacker to my sandbox, his hackerone username is https://hackerone.com/█████████ , he joined and play with the sandbox, WITHOUT KNOWING that when he submitted a test report, I already exposed his PII because i rewarded his submitted report a swag, please see below information belonging to him.

Complete Name: ██████████ Street: ████ City: ███████ State/Province: ███ Postal Code: ████ Country: ██████████ Phone Number: ███

The other information on the screenshot is for Name: John Doe and those information is belonging to the demo-member.

This bug can be used to expose any target of your choice :)

{F301676}

Mitigation:

Hackers swag information (PII) should not send to the Sandbox or Non-approved program owner since this is a testing only and live production hacker information should not be able to disclosed!.

Impact

Information disclosure, exposing hackerone users personally identifiable information.

Let me know if anything else is needed, please ask question if you are having trouble understanding my report, I'd be glad to provide as much as information if needed.

Regards Japz