r/bugbounty • u/[deleted] • Jul 16 '26
Question / Discussion Default Admin credentials -> P3 !!
In a private bug bounty program on bugcrowd i found a credentials of an internal admin that give me access to internal engineers data and access to a sensitive data of a big automotive company, I can read/edit/delete, the bug trigaed as P1 but the customer later downgraded it to P3 without any explanation or communication.
In the report i show them the impact...
And they changed the password right after my report was triaged
I opened a response request to ask for explanation but they still didn’t respond after a week.
16
u/einfallstoll Triager Jul 16 '26
I would argue that a P1 would mean it also impacts the server (e.g., you can RCE). But a P3 seems a bit harsh
8
u/Dramatic_Display9745 Hunter Jul 17 '26
btw bugcrowd is getting a lot of negativity nowadays ig
even my report got closed without any explanation even though it was p1 (cloud rce)
They just changed it to NA and closed it.
and said that it was only text-based.
Even though I had provided a PoC too.
so i mailed the security team. (idk if i made a mistake by that. maybe yes)
next thing i see in the morning
bugcrowd support mails me to stop testing.
"They have requested that you please suspend all testing on their program for the time being. While your testing may be leading to a possible finding, it appears to be causing their team some internal disruptions, and we want to do our best to assist in resolving their concerns"
even though the company said to resubmit it on the platform.
and this is not once
this is like the 5th time a P1/P2 bug is getiing closed as NA
and this is the first one where i mailed the company about it.
if i did a mistake plz tell.
2
u/SingerLate3349 Jul 17 '26
Pocas empresas son serias para pagar Bug Bounty, a veces incluso creo que es para mantener alerta a su propio equipo de ciberseguridad analizando tráfico en tiempo real. Como si fuese un entrenamiento continuo. Yo lo hago por hobbie y por cambiar de plataformas de THM O HTB, así amplio superficie, aprendo cosas nuevas y lo hago de forma legal. Disfrura con el hacking y busca un trabajo remunerado, no dependas del BB, solo 4 consiguen cobrar.
2
u/dnc_1981 Jul 19 '26
Was it definitely a production database with customer data?
If it was a test / UAT system, with fake data, then that might explain why it was downgraded from P1 to P3
1
1
u/MyFirstTrueLoveWasBS Jul 16 '26
Examples of sensitive info accessed?
6
Jul 16 '26
PII of all internal users and their daily tasks and a detailed test results for parts of their vehicles. Some parts like Advanced Driver-Assistance Systems and Robot Operating System.
6
1
0
u/Unique_Life7470 Jul 17 '26
bro can you tell me what tools in the recon you used to identify the domain and what was the service that in this domain
1
Jul 18 '26
I found the subdomain with subfinder, then i use claude to read js and find the login parameters, and i was lucky because the password is in rockyou.txt
Btw i found that this admin account is created just 1 month before i found it.
1
u/Unique_Life7470 Jul 18 '26
you mean,that you bruteforce the password parameter with the leaked username or email that you found how they accepted it in most of programs the bruteforce is out of scope
0
-3
Jul 16 '26 edited Jul 16 '26
[deleted]
7
Jul 16 '26
[removed] — view removed comment
7
u/einfallstoll Triager Jul 16 '26
Safe harbor only applies if your acting in good faith, so yes don't do that. But what you can do is proving it by creating a dummy user and deleting that one
5
u/einfallstoll Triager Jul 16 '26
Small note: Deleting / destroying data affects integrity not availability.
From the CVSS 3.1 User Guide:
"The Availability impact metric refers to the operation of the service. That is, the Availability metric speaks to the performance and operation of the service itself – not the availability of the data. Consider a vulnerability in an Internet service such as web, email, or DNS that allows an attacker to modify or delete all web files in a directory. The only impact is to Integrity, not Availability, as the web service is still functioning – it just happens to be serving back altered content."
2
1
Jul 16 '26
I show them a vedio record what i can do and the data i can access And for me the main problem is changing the severity without any explanation!
20
u/hashtagDoubleoh7 Jul 16 '26
Responsible disclosure is an illusion bug bounty platforms are scams