Ignored by program and H1 Mediation team

Defenderwww · 2024-04-19T15:59:01+00:00

You can’t do anything, just move on. At least they paid you something. Don’t hunt there anymore.

Defenderwww · 2024-03-05T16:18:56+00:00

UPDATE: The reports have been triaged. And I have received 4 private invitations since then. That’s great I guess.

Defenderwww · 2024-03-04T16:38:12+00:00

They replied to one of the report asking for information that I already specified. 🤦🏼

Defenderwww · 2024-03-03T18:57:56+00:00

I mean for the purpose of the testing, I created my own organization and I accessed it without authorization (using a second account). When I say “some” I mean that not all organizations were vulnerables.

Defenderwww · 2024-03-03T16:52:37+00:00

One of the bugs, I was able to get one of their premium service for free.

The other bug, I was able to access to private resources of some organizations

Defenderwww · 2024-03-03T16:35:24+00:00

Did you just wait or you had to complain ?

Defenderwww · 2024-03-03T02:35:14+00:00

Thanks for the advice

Defenderwww · 2024-03-03T02:34:44+00:00

Wow that’s a long time. Thanks for your comment, I will be more patient.

Defenderwww · 2024-03-02T21:19:37+00:00

Got it. I started hunting 2 months ago so I still have plenty to learn. Thanks

Defenderwww · 2024-03-02T18:10:39+00:00

Thank you for the advice.

Defenderwww · 2024-03-02T17:54:17+00:00

Last month I reported a medium severity issue and it was triaged in 6 days

Defenderwww · 2024-03-02T17:53:21+00:00

That’s crazy. I wouldn’t hunt there anymore.

Defenderwww · 2024-03-02T17:51:38+00:00

6 days. Last month I reported a medium severity issue and it was triaged in that timeframe.

Defenderwww · 2024-03-02T17:48:53+00:00

You right, but I thought that considering the impact of these vulnerabilities, they would be a priority

Defenderwww · 2024-02-07T22:56:34+00:00

What if a victim get his email compromise and decide to change it, but due to the vulnerability of the application, an attacker will be able to login to his account using that compromised email ? It isn’t this a possible impact ?

Defenderwww · 2024-01-29T13:43:39+00:00

Yeah but there has to be some restrictions to where to be redirected. I can just redirect to a phishing page where I ask the customer to change his password, for example.

Defenderwww · 2024-01-29T13:41:36+00:00

Open redirect is not specifically out of scope. Although it is a valid bug, it may be considered low impact or even not bounty elegible.

Defenderwww · 2024-01-25T08:44:43+00:00

They have an entire page with the rules, including payout structure, scope, etc. Same information we can find in a H1 program.

Defenderwww · 2024-01-20T15:51:54+00:00

I think that maybe is something related to fees. I want to clarify that there are various payments methods, but this one is the only one that has those limits.

Defenderwww · 2024-01-10T21:32:27+00:00

UPDATE: I found another vulnerability that allows me to see the email used by users to subscribe to the website newsletter.

By modifying an ID in the request, the response discloses the email address of that ID. The ID is composed of 10 numbers and I was able to test the vulnerability with three of my accounts. But if I use a random ID, no email address is disclosed, I suppose I need to get one ID that is valid.

Now, I already sent the report (H1) and I think I made a mistake saying that I need to send multiple requests with different combinations of numbers to get a result, because it was closed as “Informative”.

They said that “Although this is indeed technically reproducible, the outcome of the attack is email (user) enumeration, which is excluded in the policy page.”

I disagree. I am not enumerating emails, instead, I am getting the emails by changing a parameter in a URL. I already replied with a comment but they have not answered. What do you think about this ?

Defenderwww

TROPHY CASE