Summary

On November 8th, 2018, HackerOne released software to production that contained a bug which impacted our Security Assertion Markup Language (SAML) authentication system. As a result of the bug, the SAML JIT (Just-In-Time) provisioning mechanism granted users of one customer program read-only access to another customer program. Users who signed in after the software code was pushed into production were inadvertently added as users to 12 other customer programs. The scope of this faulty software behavior was 12 customer programs and 34 user accounts of customers.

Timeline

Impacted Data

Between 12:48 PM and 1:31 PM PST on November 8th, 2018, 34 employees of HackerOne customers had access to certain program details in one or more programs other than their own. A total of 12 customer programs and 34 customer user accounts were involved.

During that time, the users had read-only permissions which gave them access to reports (titles, vulnerability information) as well as some program details, such as common responses and dashboards. Seven programs had vulnerability reports viewed by unauthorized employees. Four programs had their inboxes viewed, which disclosed report states, titles, issue tracker references, reporter, assignee, and when the report was last updated. However, for those four programs, no vulnerability descriptions were accessed. One impacted program had no data accessed at all. Impacted customers were notified as to what pieces of data were accessed.

Customers’ employees were also impacted. There were 34 customer usernames and email addresses that were shared with other customers without their authorization as they were added to customer programs. These individuals were notified regarding this unintended access.

If your data was accessed during this incident, you have received a separate notification from HackerOne.

Root Cause

A refactor of the SAML JIT provisioning code path incorrectly scoped a data query that resulted in returning the affected programs. When a user authenticated via SAML after the software containing the bug was released, they were immediately added to at least one of the affected programs. The user was not assigned to any permission groups within the program, giving them the default “read-only” access that allows them to view program details, reports and make internal comments.

Resolution and Recovery

At 1:08 PM PST, the engineering on-call duty was notified of unexpected users being added to programs. At that time an incident response team identified that a release at 12:48 PM PST included a change to SAML JIT provisioning. At 1:17 PM PST, the team decided to disable the SAML JIT provisioning system to reduce the impact of the issue.

By 1:31 PM PST, the incident team decided to put production into maintenance mode in order to safely investigate the extent of the unauthorized access. HackerOne customers that signed in after the code release were inadvertently added to 12 other programs. A total of 34 customer user accounts were involved, and each was added to the 12 programs impacted. At 1:51 PM PST, all changes as a result of the bug were reverted.

Before restoring full functionality, the incident team investigated the extent of the impact to identify what unauthorized access occurred as well as what personal user data was exposed. Once the investigation was complete, the site was restored to full functionality at 2:52 PM PST. At this time, SAML JIT provisioning is disabled until the feature has undergone a further review.

This was not eligible for a bounty, as the HackerOne team was first to identify the issue.

Preventative Measures

As part of our incident response process, we are conducting an internal review and analysis of the incident. We are taking the following actions to address the underlying causes of issues and to help prevent future occurrence:

• Improve our staging environment to include SAML JIT provisioned programs to more closely mirror our production environment, so we can identify similar bugs before release
• Improve our database schema to limit the reach of queries executed by the system
• Improve data access logging to identify affected parties in a more efficient and timely manner in the future
• Improve model-level validations to include additional business logic rules that would prevent edge cases that cannot be hit through normal application usage
• Increase our positive as well as negative path testing in both integration and acceptance tests