Lark Technologies · Report #659565
Server Side Request Forgery
Validstatus
lowseverity
9upvotes
18 Mar 2021disclosed
Summary
It was found that one lark endpoint was susceptible to a Server-Side Request Forgery (SSRF) vulnerability using the parameter "URL" which could have potentially been used by an attacker to conduct host/port scanning on the internal network. We thank @jin0ne for reporting this to our team and confirming the resolution.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.