A HackerOne platform that allows security researchers to inform developers about vulnerabilities and receive rewards for it has been subjected to its own breach. One researcher managed to gain access to the account of a security analyst at HackerOne, who had the ability to view confidential materials, including information on unresolved vulnerabilities. Over the duration of the platform, a total of $23 million has been paid to researchers for discovering vulnerabilities in the products of more than 100 clients, including Twitter, Facebook, Google, Apple, Microsoft, Slack, the Pentagon, and the U.S. Navy.
Notably, the account takeover was made possible due to human error. One of the researchers submitted a report about a potential vulnerability in HackerOne. During the review of the report, a HackerOne analyst attempted to replicate the proposed hacking method, but was unable to reproduce the issue, and a response was sent to the applicant requesting additional details. However, the analyst did not notice that, along with the results of the unsuccessful check, they inadvertently sent the contents of their session cookie. Specifically, during the dialogue, the analyst provided an example of an HTTP request executed with the curl utility, including HTTP headers, from which they forgot to clean the contents of the session cookie.
The researcher noticed this oversight and was able to gain access to a privileged account on hackerone.com simply by using the observed cookie value without needing to go through the multi-factor authentication that the service employs. The attack was possible because hackerone.com did not apply session binding to the user's IP address or browser. The problematic session identifier was deleted two hours after the leak report was published. The researcher was decided to be rewarded with $20,000 for reporting the issue.
A HackerOne audit was initiated to analyze potential past Cookie leak occurrences and to assess possible leaks of sensitive client issue information. The audit found no evidence of leaks in the past and determined that the researcher who demonstrated the problem could access information about approximately 5% of all programs presented in the service, which had been made available to the analyst whose session key was used.
To protect against such attacks in the future, session key binding has been implemented to IP-cím alapján határozza meg a helyet and filtering of session keys and authentication tokens in comments. In the future, binding to IP is planned to be replaced with binding to user devices, as IP binding is inconvenient for users with dynamically assigned addresses. It has also been decided to expand the logging system with information about user access to data and to implement a granular access model for analysts concerning client data.
Forrás: opennet.ru
