Attacker may be able to bounce enough emails which suspend HackerOne's SES service and cause a DoS of HackerOne's email service

Summary

This was a DoS based on triggering a lot of bounced emails via SES service which could put our email sending up for review with AWS. The vulnerability was due to unrestricted invitations on sandbox programs which allowed an attacker to generate an infinite number of bounced emails. We had applied a fix by limiting program invites in sandbox programs, but it was an incomplete fix as demonstrated by @iamr000t.

Why Limited Disclosure? We don't usually limit disclosure, but there were a lot of emotional responses and far too much to redact that would have made it difficult to follow the report.

while testing on hackerone I came across an interesting endpoint which allowed program members to invite hackers to their program, I made following observations :-  1.)No rate limiting enforced while inviting other hacker.  2.) No, RFC 5322 verification while sending invites.

I used a simple payload that was "anyemail$[email protected]" and sent an email invitation, and to my surprise the email was accepted and invitation was sent however according to RFC5322 email like that can not actually exist because HackerOne uses AWS SES for emailing services as an attacker I could have used this issue to terminate HackerOne's SES account . Although after reporting this issue my report was first marked as not applicable and a duplicate to Email Spamming (all thanks to my lack of report writing skills I guess) and due to some misunderstandings and miscommunications I later on did some damage and my report was marked as ineligible for bounty. although the issue was valid and fixed (closed as resolved ) and I learnt a lot about testing for DoS attacks safely so it is a win win for everybody.

Lesson Learnt: Always test for DoS attacks carefully & Follow the Bend but not break approach

Link To the full writeup : https://medium.com/@NinadMishra/dos-and-bugbounties-a-series-of-dos-attacks-on-hackerone-9c8316e192c9