4 ms·
I found a XSS bug in a popular note taking app. It would allow an attacker to download all the users notes just by having them visit a URL. I reported it on Ha
by justsomeuser 6y ago
I found a XSS bug in a popular note taking app. It would allow an attacker to download all the users notes just by having them visit a URL.
I reported it on HackerOne, it was only after I refused to post it on their free program that they added me to their paid private one.
It was marked as "medium", I got $250 for it.
- tptacek 6y agoThat's a pretty normal price for an XSS.
- justsomeuser 6y agoDropbox and co pay $10,000 for the same exploit.
- tptacek 6y agoThen you should sell it to Dropbox, because $10,000 is extremely high for an XSS vulnerability.
- justsomeuser 6y agoI do not have the market rates for vulnerabilities, but I do know some pen testing companies charge $10,000 for a few days of work that may not return any concrete bugs. Compared with hiring a pen testing team, offering high bounties seems like a bargain as you get actual exploits that would impact the company.
- tptacek 6y agoYes, that is the premise behind bug bounties. If you're a vulnerability researcher with a track record, you will probably make better money and certainly more consistent money as a pentester. Many pentesters just do both. I have, uh, some experience with the rates here.
- KajMagnus 6y agoCan I ask, if you were the owner of the popular note taking app, what bounty would you want to have paid for that vulnerability? I.e.: "XSS bug in a popular note taking app ... attacker to download all the users notes just by having them visit a URL" So as to not feel worried that future vulnerabilities would get sold on the black market instead
- tptacek 6y agoXSS? Outside of a social network, where it can propagate itself? For a non-FAANG-scale company? Probably between $250 and $500, if it's a clean and effective XSS. Less if you have to interact with an obscure feature of the application.
- KajMagnus 6y agoThanks for the reply, I would have guessed maybe 10 x more. Interesting to hear, Makes me think that there is not any big marked for exploits targeting smaller companies. Maybe such exploits (for smaller products) would be useful primarily for spear phishing? and not bring in so much money if sold, & hard to find a buyer? Still, if the note taking app was sth well known like Ev*rnote, I wish they'd pay more. (No idea if it was.)
- jsploit 6y agoDo you disagree with the severity? I assess it to have a 6.5 (medium) CVSS score. https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L...
- justsomeuser 6y agoI realise it’s a medium on that scale and I cannot argue otherwise. But I think how private that data is to the end user should also be taken into account. It’s a medium for technical risk (relative to server remote exec), but it should be seen as a high priority for the company and rewarded as such. If an end user were to ask that company “why did you leak all my private data” their response would be “your data is worth less than $250 in human labour and is seen as a medium security risk”?
- jsploit 6y agoThe authenticated one-click social engineering aspect of this significantly lowers exploit probability and overall risk.
- justsomeuser 6y agoThis is true, but this attack could work in an Iframe in the background without that click. An attacker could buy a popular blog on the note taking app, and run the Iframe in the background collecting data for years. The bug was at least 5 years old.
- tptacek 6y agoCVSS is a ouija board and you can make it say whatever you want, which is why very few practitioners take it seriously.
- jsploit 6y agoSure, some of it is open to interpretation, but I disagree with it not being taken seriously. This is the basis for CVEs, most bounty tables, and most audit reports (that I've seen).