The bug bounty platform HackerOne has paid a $20,000 bounty to an outside hacker after it accidentally gave them the ability to read and modify some of its customers bug reports.
It all began when the outsider, who is a HackerOne community member with a proven track record of finding vulnerabilities, was communicating with one of the company's security analysts. The HackerOne analyst sent the user, who goes by the handle haxta4ok00, parts of a cURL command.
However, the cURL command the analyst sent mistakenly included a valid session cookie which could be used by anyone who possessed it to read and even partially modify all of the data the analyst had access to.
- Microsoft paid out millions in bug bounties last year
- Valve updates bug bounty rules after Steam zero-day controversy
- Google offers million-dollar bug bounty reward
Luckily HackerOne was able to quickly revoke the session cookie just two hours after haxta4ok00 first reported the incident.
Exposed data
At this time, HackerOne is not saying just how much data was exposed by the security analyst's mistake. In a recently published incident report though, the company said that all affected customers have already been notified privately.
The report also revealed that the exposed data was limited to reports the security analyst had access to. However, the disclosure does not even provide any clues as to how many customers or how much data was affected. A day after the incident occurred, HackerOne cofounder Jobert Abma wrote to haxta4ok00, saying:
“Something came up that we hadn’t asked you yet. We didn’t find it necessary for you to have opened all the reports and pages in order to validate you had access to the account. Would you mind explaining why you did so to us?”
Haxta4ok00 responded to this question by saying that he opened all of the reports and pages in order to “show the impact” and did not intend any harm to either HackerOne or its customers. This explanation wasn't enough for Abma who replied, saying: “This became a bigger incident due to the amount of data that you accessed, not because it happened in the first place.
Haxta4ok00 still received a bounty of $20,000 for his discovery while learning the valuable lesson that just because files have been accidentally made accessible to you, it doesn't mean you should open them.
- Keep your devices protected with the best antivirus software
Via Ars Technica
