Race condition allows to send multiple times feedback for the hacker
业务逻辑 / Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') / #1132171
该报告还没有中文解读。
原文摘录
摘自原文（2159 字符中的一小部分）
We've found out that the program's should be able to send feedback only once per report which is very logical. However, the program user is able to send multiple parallels requests which will lead to the race condition situation and will send multiple feedback to the hacker.
原文中的代码
POST /hacker_reviews HTTP/1.1 Host: hackerone.com User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36 Accept: application/json, text/javascript, */*; q=0.01 Accept-Language: fi-FI,fi;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: …
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 HackerOne 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @muon4 · 版权归作者与 HackerOne 所有