X.509 certificate validation fails on international vanity domains
None
Y
Yelp
Submitted None
Actions:
Reported by
tk0
Vulnerability Details
Technical details and impact analysis
This is not an vulnerability, more likely TLS/SSL related configuration issue with certificates noticed during bug bounty testing.
If you try to access any Finnish domain (such as my HackerOne test-profile http://tomitest.yelp.fi/), there will be an certificate related error presented to user. You can try with any other Finn URL's and you'll notice this affects all other too.
Most probably users are not able to access Finnish Yelp domain pages without some extra hassle/confusion. Basically *.com* works fine, but *.fi* doesn't. Anyways, since Yelp provides *.fi* domain if you're are an Finn (like me), I assume both should work for user profiles.
I've added two screenshots to aid this finding:
1. Certificate error presented by Google Chrome.
2. Link from my testpage (Yelp's localized profile page address via get your own url)
Cheers,
-Tomi
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Submitted
Weakness
Violation of Secure Design Principles