Loading HuntDB...

Denial Of Service (Out Of Memory) on Updating Bounty Table [Urgent]

Low
H
HackerOne
Submitted None

Team Summary

Official summary from HackerOne

@ahmd_halabi reported a client-side Denial of Service vulnerability to us. A video proof of concept detailing the issue can be found in https://youtu.be/NJUikSh1uro.

Reported by ahmd_halabi

Vulnerability Details

Technical details and impact analysis

Uncontrolled Resource Consumption
Hello, **Summary:** There is a bug in Updating Bounty Table section causing Denial Of Service , specifically loading up the memory usage (Out Of Memory). This happens when you visit a corrupted bounty table of a target program. I didn't figure out yet how this issue happened but I am reporting it now immediately because it affects all hackers who view the bounty table of the target affected program. **Description:** The issue happened with me when I was clicking on a notification telling that `Clario has updated their bounty table`. So I clicked on it to see the updated bounty table and suddenly my browser tab crashed and a message showed telling `Error code: Out Of Memory`. I tried it from two hackerone accounts and they results with the same issue. ### Steps To Reproduce 1. Navigate to the notification: https://hackerone.com/clario/bounty_table_versions?nid=115515717&utm_campaign=user_652675&utm_content=team_url&utm_medium=email&utm_source=bounty_table_update 2. You will not be able to click on any button (Ex: profile or Inbox). 3. After short while, Browser will crash. ### Optional: Your Environment (Browser version, Device, etc) Google Chrome. ### Optional: Supporting Material/References (Screenshots) Please see the attached image and quick video PoC ██████████ {F1093466} ### Optional: Did you use [recon data made available by HackerOne](https://github.com/Hacker0x01/helpful-recon-data) to find this vulnerability? no ## Impact Denial Of Service (Out Of Memory) - Crashing whole Browser (happened with me) and loading up computer resources (CPU and RAM). Kind Regards.

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Submitted

Weakness

Uncontrolled Resource Consumption