1 bug, $50,000+ in bounties, how Zendesk intentionally left a backdoor in hundreds of Fortune 500 companies
gist.github.com
1 bug, $50,000+ in bounties, how Zendesk intentionally left a backdoor in hundreds of Fortune 500 companies - zendesk.md

hi, i’m daniel. i’m a 15-year-old with some programming experience and i do a little bug hunting in my free time. here’s the insane story of how I found a single bug that affected over half of all Fortune 500 companies:

  • troed@fedia.io
    0·
    1 month ago

    Despite fixing the issue, Zendesk ultimately chose not to award a bounty for my report. Their reasoning? I had broken HackerOne’s disclosure guidelines by sharing the vulnerability with affected companies

    Regardless of everything else they should be kicked out from HackerOne since it’s clearly Zendesk not being truthful here.

    • JordanZ@lemmy.worldEnglish
      0·
      1 month ago

      They posted a link to their blog post down in the comments of the gist…

      We also want to address the Bug Bounty program associated with this case. Although the researcher did initially submit the vulnerability through our established process, they violated key ethical principles by directly contacting third parties about their report prior to remediation. This was in violation of bug bounty terms of service, which are industry standard and intended to protect the white hat community while also supporting responsible disclosure. This breach of trust resulted in the forfeiture of their reward, as we maintain strict standards for responsible disclosure.

      They failed to mention that the report was closed for being out of scope. Any reasonable person would expect that to mean a remediation was not coming. So really he didn’t give up his bounty because he wasn’t getting one to begin with.

      Edit: cause autocorrect is dumb.

      • Possibly linux@lemmy.zipEnglish
        0·
        1 month ago

        Sounds like they just didn’t want to pay this guy. That is so dumb as if they lose even a few customers they are going to be in negative. They should of paid him and then turned this into a PR positive.

    • elvith@feddit.orgEnglish
      0·
      1 month ago

      I couldn’t help but find it amusing—they were now asking me to keep the report confidential, despite having initially dismissed it as out of scope.

      “Sorry, but per your own guidelines this is out of scope. Because of this, this bug is not part of the agreement and guidelines on Hackerone. You can find my full disclosure, that I wrote after your dismissal here: <Link>” /s

      • bjornsno@lemm.eeEnglish
        0·
        1 month ago

        I mean, that still allows zendesk to reply with “oh yeah that’s also why we’re not paying the bounty”

        • elvith@feddit.orgEnglish
          0·
          1 month ago

          Well, they did it anyways, so…

          Also this might work as an answer to “yeah, it’s a bug, but we won’t pay you”