IDOR on Program Visibilty (Revealed / Concealed) against other team members
不安全的直接对象引用 / IDOR / #291721
该报告还没有中文解读。
原文摘录
摘自原文（4486 字符中的一小部分）
When you are a part of a program security team, you have a choice to show in your profile that you are a member of the sec team, you can also hide it if you don't want to show it to your profile, any team member can do that using your profile settings here: https://hackerone.com/settings/teams > …
原文中的代码
POST /graphql HTTP/1.1 Host: hackerone.com User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:56.0) Gecko/20100101 Firefox/56.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate content-type: application/json x-auth-token: …
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 HackerOne 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @japz · 版权归作者与 HackerOne 所有