0

There is a site which hosts coding competitions for coding and placements. They issue certificates for winning the coding exam or at least get into the finale round.

I did not participated in that competition but my friend did. He posted the certificate on LinkedIn with the links of it.

I being on the same coding platform as a user, clicked on the certificate link and was navigated to the certificate page, and BOOM I see my name in the certificate instead of that guy.

Well, I quickly went to incognito mode of the browser and made a fake dummy account, copied and pasted that url and again BOOM, the certificate shows that DUMMY name.

Is it a bug in that coding platform?? with this can I be eligible from bounty?

What is the severity of it knowing that it is Coding and Hiring platform??

What should I call this vulnerability in Technical term?

Note: When I log out from my coding platform account and then click on that link then it says to log in to view the certificate. SO clearly it is related to session in the browser.

The website states the following about eligibility:

Some common security-related issues could include the following:

  • Cross-Site Request Forgery (CSRF)
  • Cross-Site Scripting (XSS)[Stored XSS/DOM XSS/Reflected XSS which affects other users]
  • Code Executions
  • SQL injections
  • Server Side Request Forgery (SSRF)
  • Privilege Escalations
  • Authentication Bypasses
  • File inclusions (Local & Remote)
  • Protection Mechanism bypasses (CSRF bypass, etc.)
  • Leakage of sensitive data
  • Directory Traversal
  • Payment manipulation
  • Administration portals without authentication mechanism
  • Open redirects which allow stealing tokens/secrets

The following is listed as an example for ineligibility:

  • Application stack traces (Path disclosures, etc.)
  • Self-type Cross Site Scripting
  • Self affecting Reflected Cross Site Scripting
  • Denial of Service attacks
  • CSRF issues on actions with minimal impact
  • Brute force attacks
  • Security practices (banner revealing a software version, etc.)
  • Vulnerabilities on sites hosted by third parties unless they lead to a vulnerability on the main website.
  • Vulnerabilities contingent on physical attack, social engineering, spamming, DDOS attack, etc. V> * ulnerabilities affecting outdated or unpatched browsers / Operating Systems.
  • Vulnerabilities in third party applications.
  • Bugs that have not been responsibly investigated and reported.
  • Bugs already known to us, or already reported by someone else (reward goes to first reporter).
  • Issues that aren't reproducible.
  • Issues that we can't reasonably be expected to do anything about.

Am I eligible for the bounty?

  • 1
    I would call this "Business logic flaw in certificate generation module". However, the impact assessment is key here. You need to answer questions like: How these certificates are used by end users? Can they be added to your linked in profile? Do recruitment partners have a way to verify the certificate with the issuer? If this certificate really anything more than a gimmick? once you have these answers, explain the impact to the affected party and hope for the best. – Shurmajee Nov 11 at 10:18
  • @Shurmajee , yes people are able to add the images of certificate on LinkedIn, but in URL they are able to redirect the session and thus the name is being changed. :) – Vishwa Ratna Nov 11 at 10:22
1

What kind of vulnerability is this?

This kind of vulnerability is usually referred to as "Business Logic Abuse". Business Logic refers to any business-related process, such as "If people reach the finale, they get a certificate".

The fact that you can get a certificate without participation is a way to circumvent this business logic.

Will this be eligible for a bug bounty?

No. Their website lists which kinds of vulnerabilities are eligible for a bug bounty and your vulnerability is not among those. Furthermore, your vulnerability has absolutely minimal impact, and a forged certificate could be made in a number of ways (e.g. image manipulation software, etc.)

  • Hi mate! I just got a reply from the platform and they said that they have accepted my bug. :) – Vishwa Ratna Nov 12 at 8:39
  • @VishwaRatna That's very nice. Keep in mind I said you're likely not eligible for a bug bounty, not that they would not accept the bug report. It's a bug after all, just not one with a high impact. – MechMK1 Nov 12 at 10:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.