HackerOne · Report #80118

Information leakage - Private reports cached by Google

Informativestatus

8upvotes

23 Jul 2018disclosed

Summary

We have received a lot of submissions describing this behavior. Therefore, we have decided to publicly disclose the original report in an effort to expose the reasons why we can't really have any control over third-party caching services.

How it was found

Hello, I have found at least two private bug reports cached by Google. (#10259 and #10257). Possibly more available Cached version is exposing title and part of the bug description

POC: http://webcache.googleusercontent.com/search?q=cache:AnHgIn9Ed-UJ:https://hackerone.com/reports/10259%2Bsite:https://hackerone.com/reports/10259&lr=&hl=en&prmd=ivns&strip=0&vwsrc=1

POC2: http://webcache.googleusercontent.com/search?q=cache:DXcBa6CGcTYJ:https://hackerone.com/reports/10257%2Bsite:https://hackerone.com/reports/10257&lr=&hl=en&prmd=ivns&strip=0&vwsrc=1

I have attached some screenshots Thanks

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original