HackerOne Disclosed Reports - 2025-05-12

Critical
resolved

Netlify Authentication Token Exposed in Public Mozilla CI Logs

Bug reported by Samir Sec was disclosed at May 13, 2025, 9:35 am   |   Information Disclosure

A critical vulnerability was discovered involving the exposure of a Netlify authentication token within publicly accessible logs. The token provided full access to the "Mozilla IT Web SRE" Netlify account, bypassing all restrictions. The token's permissions encompassed roles such as Owner, Developer, Billing Admin, Reviewer, Publisher, and Content Editor, granting complete control over site management, deployments, billing, and content configurations.

Critical
resolved

insecure deserilize object leads to RCE On Sitecore (CVE-██████████-27218)

Bug reported by reinhardt was disclosed at May 12, 2025, 4:04 pm   |   Deserialization of Untrusted Data

This critical vulnerability involved an insecure deserialization issue in Sitecore implementation, which was assigned CVE-2025-27218. The vulnerability allowed remote code execution through unsanitized user input in the ThumbnailsAccessToken header. The vulnerability was remediated by removing public access to the affected site, which was then protected behind Cloudflare WAF.

Medium
resolved

Users Data Exposure via Insecure Endpoint

Bug reported by BugHunter0x7 was disclosed at May 12, 2025, 3:52 pm   |   Information Disclosure

An insecure endpoint on the Mars Royal Canin website exposed sensitive customer information without proper authentication. Personal data, including full names, phone numbers, email addresses, physical addresses, and postal codes, was accessible through a simple API endpoint that could be accessed by anyone. The endpoint revealed customer data when provided with a numeric code parameter, and all user information could potentially have been accessed by brute-forcing this parameter.

Low
resolved

debug.log leaked [█████████]

Bug reported by Ti.13Ica was disclosed at May 12, 2025, 3:45 pm   |   Information Disclosure

The report identified a security vulnerability in the visitor management system that exposed a debug log file containing personally identifiable information. The log file was publicly accessible without authentication, allowing unauthorized access to sensitive user data. The vulnerability was classified as an instance of insecure storage of sensitive information. The issue was subsequently resolved when the website was closed at the end of 2024.

Medium
resolved

massive PII leakage for ███████

Bug reported by thpless was disclosed at May 12, 2025, 3:44 pm   |   Insecure Storage of Sensitive Information

The report identified a security vulnerability in the visitor management system (mwcvisitor.royalcanin.com.cn) that exposed a log file containing personally identifiable information (PII) of users. The log file was directly accessible through a public URL without any authentication, allowing unauthorized access to sensitive personal data. The vulnerability was confirmed and subsequently resolved by the Mars team, as the site was closed at the end of 2024 and the endpoint is no longer accessible.

Critical
resolved

change part of personal information all users

Bug reported by BugHunter0x7 was disclosed at May 12, 2025, 3:13 pm   |   Improper Access Control - Generic

The report describes a vulnerability in the ██████████ website, where unauthorized access to an API endpoint allowed attackers to add new users and modify personal information of existing users. The vulnerability was classified as Improper Access Control. The issue stemmed from the absence of proper authentication and authorization mechanisms on the ██████████ endpoint, which handled user registration and profile updates. This vulnerability allowed anyone to create new user accounts or modify existing user information without requiring any authentication. Additionally, the vulnerability was compounded by a predictable user identifier system (4-digit codes) that could be easily enumerated through brute force methods to identify valid user profiles through the ██████████ endpoint.