Unauthenticated user can upload an attachment to the last updated report draft

Summary

"What, HackerOne resolved a report that was submitted by @jobert?"

At HackerOne we often find security vulnerabilities ourselves. In most cases, we find them before new features even make it into production. Sometimes we find them when they're already in the wild. Recently we've launched a new feature called retesting. Up until now, HackerOne would always retest our own findings. We're changing that. This is the first report we identified ourselves where we're expanding retesting to the community. When we identified this vulnerability, we filed a ticket to our own bug bounty program instead of filing an internal ticket. We then leveraged the community to retest the vulnerability and allow them to find a bypass.

This particular security vulnerability allowed an unauthenticated user to upload attachments and attach them to the last created report draft of other users. This was possible by sending a specially crafted request to the /attachments endpoint. Our investigation concluded that this was not abused.

Thanks to the hackers that retested this vulnerability!