Lark Technologies · Report #876022
RPC Implementation allows unauthenticated remote calls
Validstatus
highseverity
$1,250bounty
39upvotes
10 Feb 2021disclosed
Summary
It was found that the RPC implementation via postMessage within Lark did not check origin, so an attacker could have potentially performed RPC calls on behalf of a user. We thank @mike12 for reporting this to our team and confirming the resolution.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.