LY Corporation · Report #740037
Request smuggling on admin-official.line.me could lead to account takeover
Summary
The reporter identified a request smuggling issue on admin-official.line.me (TE.CL-type). The reporter clearly illustrated the impact without putting our users at risk or affecting the stability of our service. For this we would like to thank @shaolin_tw!
This issue was the result of how our load balancers were forwarding requests to the backend services. It had widespread influence and the report allowed us to resolve the issue internally, as well as make the vendor of the load balancers aware of this possible issue when using their product. The contents of the report allowed us to identify and prevent similar issues elsewhere in our infrastructure
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.