HackerOne awards $20,000 bug bounty after leaking session cookie to hacker
Credit:
Port Swigger
Bug bounty platform HackerOne this week paid out a $20,000 bounty after a researcher was able to access other users’ vulnerability reports.
Haxta4ok00, a HackerOne community member who apparently has a track record of discovering vulnerabilities in the bug bounty platform, was engaged in a conversation with one of HackerOne’s security analysts.
In one message, the analyst copied a cURL command from a browser console and sent it to the hacker. The analyst accidentally included a valid session cookie that gave the ability to read the data that they had access to. This included report titles, a certain amount of metadata, and some report contents.
