HexBrain

LY Corporation · Report #740037

Request smuggling on admin-official.line.me could lead to account takeover

Validstatus
highseverity
565upvotes
19 May 2020disclosed

Summary

The reporter identified a request smuggling issue on admin-official.line.me (TE.CL-type). The reporter clearly illustrated the impact without putting our users at risk or affecting the stability of our service. For this we would like to thank @shaolin_tw!

This issue was the result of how our load balancers were forwarding requests to the backend services. It had widespread influence and the report allowed us to resolve the issue internally, as well as make the vendor of the load balancers aware of this possible issue when using their product. The contents of the report allowed us to identify and prevent similar issues elsewhere in our infrastructure

How it was found

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original