Lark Technologies · Report #810401
SSRF with information disclosure
Validstatus
mediumseverity
64upvotes
27 Apr 2021disclosed
Summary
A SSRF (server side request forgery) vulnerability was identified in the messenger endpoint of Lark Suite which could have exposed internal credentials used by the server. We thank @jin0ne for reporting this to our team.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.