HackerOne · Report #418767
Hacker can bypass 2FA requirement and reporter blacklist through embedded submission form
Summary
The hacker submitted a vulnerability to us that allowed any user to bypass multiple program restrictions, such as the 2FA requirement, report rate limit, and internal abuse limits. The severity for this vulnerability was set to medium (CVSS 5.0). This vulnerability was awarded $2,500.
When we looked into the root cause of the vulnerability, we stumbled upon another vulnerability, which had a higher CVSS score (7.1). The second vulnerability that we identified allowed an attacker to gain access to other users' attachments who were writing a report at the same time. Because we identified this vulnerability due to @japz' report, we decided to award him an additional $7,500. The report itself contains an in-depth explanation of where the vulnerability originated from.
We determined that neither of the vulnerabilities have been abused.
Here's a link to @japz's own blog post about the vulnerability: https://medium.com/japzdivino/bypass-hackerone-2fa-requirement-and-reporter-blacklist-46d7959f1ee5.
We'd like to thank @japz and @mga_bobo for bringing this to our attention, this was a great find!
How it was found
Hi Team,
Summary:
A program owner can enforce the hackers to setup the two-factor authentication before submitting new reports to their program here: https://hackerone.com/parrot_sec/submission_requirements (see below image)
{F355169}
The Parrot Sec program has this feature enabled to enforce the hackers to setup 2FA before submitting reports. I removed my 2FA to test and it is good that i was block from submitting new reports (see below image)
{F355168}
BYPASS 2FA Requirements using Embedded Submission:
Now i was able to bypass this 2FA setup requirements by using the Parrot Sec program Embedded Submission Form.
Steps to reproduce:
- Login to your account and remove your 2FA on your account (if you already setup it)
- Now go to https://hackerone.com/parrot_sec and hit
Submit Reportbutton, observed that you cannot submit report unless you will enable your 2FA. - BYPASS: Get the
Embedded SubmissionURL on their policy page: i get this ->> https://hackerone.com/0a1e1f11-257e-4b46-b949-c7151212ffbb/embedded_submissions/new - Now submit report using that embedded submission form and you can submit reports without setting-up your 2FA, despite the program enforce the user to setup the 2FA before submitting new reports.
- 2FA requirements successfully bypassed!
Impact
Bypassing the enabled protection/feature of the program.
Let me know if anything else is needed.
Regards Japz