CRLF + XSS + cache poisoning = Access to Github private pages for $35k bounty

✉️ Get the 1st issue of the BBRE newsletter and sign up for the next ones ✉️

This video is an explanation of bug bounty report submitted by 17-years-old Robert Chen and 14-years-old Phillip on Hackerone to Github's private bug bounty program. The vulnerability was CRLF combined with XSS and cache poisoning that allowed reading private pages. It was paid out $35,000.

🖥 Get $100 in credits for Digital Ocean 🖥

Report:

Reporters' twitter:

Follow me on twitter:

Timestamps:
00:00 Intro
00:24 What is BBRE newsletter?
01:10 Github Pages auth flow
02:33 XSS by CRLF
04:57 Bypassing Nonce and __Host cookie
08:44 Cache poisoning
09:49 Attacking from outside the org

[BugBountyReportsExplained]

Hi! Welcome to the comment section! I hope you enjoyed the video!
You have time until Saturday 8th May to sign up if you want to receive the 2nd newsletter.

[ahmadshami]

It's amazing how 2 high school students did all that! now those are some newborn legends

[brijendarsingh]

Clear and concise explaination . thankyou for helping the community .

[estebanroman]

Holyyyy moly! This is huges! Thanks and this channel it's amazing!

[-bubby]

Another fantastic explanation, super concise and easy to understand as always! Thanks for working so hard to keep us update to date and informed. Noticing that little distinction in the source code between converting to int for accessing the page but not when setting the cookie val as a 14 and 17 year old is seriously impressive. Not to mention the cookie scoping bypasses afterwards. Pretty sure at that age I was nothing more than a dumb script kiddie pressing buttons on Havij 😂

[SPwn]

Crazy. I'm 14 and these guys are obviously doing some crazy stuff!

[bugrd_hunter]

You the man, i love your videos, and the time you put into them. I was always wondering when someone would, reverse engineer the bugs so we can see how they went about finding the bug, along with a proof of concept. I knew the young wipper snappers would rise up and make my job even harder, lol. I love that shirt, looks good on you. I go the gym as well, have to fill out my club shirts, hehe.

[blablablabla]

Success unlocked: pay back the bank for all school years.