Lark Technologies · Report #644238

Server Side Request Forgery

Validstatus

criticalseverity

164upvotes

29 Mar 2021disclosed

Summary

A SSRF (server side request forgery) vulnerability was found in the chat feature of Lark Suite on MacOS, which could have potentially been used to access services and web applications running on the internal network. We thank @jin0ne for reporting this to our team and confirming the resolution.

Details https://jinone.github.io/bugbounty-a-simple-ssrf/

How it was found

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original