Chaturbate · Report #395731

CSRF in REPORT EMOTICON feature

Validstatus

lowseverity

$250bounty

10upvotes

27 Sept 2018disclosed

Summary

The hacker found that the report emoticon endpoint did not check the csrf token. This was resolved.

Users can report to emoticons on the the basis of the expressions but the request made to https://chaturbate.com/emoticon_report_abuse/emoticon_name was a GET request which was not protected by CSRF header.

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original