Security@ email forwarding and Embedded Submission drafts can be used to obtain copy of deleted attachments from other HackerOne users

HackerOne has a number of ways for hackers to submit security vulnerabilities to a program, two of which are through an embedded submission form and through security@ email forwarding. These two features can be exploited to update a report draft created through security@ email forwarding that does …

# frozen_string_literal: true

module Teams
  class EmbeddedSubmissionsController < ApplicationController
    # ...
    def draft_sync
      draft = Interactors::ReportDrafts::UpdateOrCreate.interact_without_authorization(
        draft_id: report_params[:draft_id],
        # ...
        handle: …