# Able to view hackerone reports attachments

GitLab's HackerOne attachment mirror at h1.sec.gitlab.net served any attachment by key without auth, exposing PoCs from nonpublic reports.

- Payout: hidden
- Severity: critical
- Program: GitLab
- Found by: sateeshn
- Disclosed: 2022-07-11
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/979787
- Library page: https://bugbountylibrary.com/r/h1%3A979787
- Tags: area:web domain:web impact:data-leak impact:internal-access kind:bounty platform:hackerone sev:critical tech:rest technique:recon vuln:access-control vuln:info-disclosure

**Target:** h1.sec.gitlab.net attachment storage endpoint
**Root cause:** The attachment mirror served files by predictable/guessable content key with no authorization check, so anyone with a key could fetch attachments belonging to nonpublic HackerOne reports.
**Steps:**
1. Open `https://h1.sec.gitlab.net/a/` to list/view attachments and copy a content key
2. Request `https://h1.sec.gitlab.net/a/<copied_key>.jpg` to view the attachment
3. Find a HackerOne report key from a linked GitLab issue, then request `https://h1.sec.gitlab.net/a/<key>`
4. Confirm `https://hackerone.com/reports/446237` returns access denied while its attachment at `https://h1.sec.gitlab.net/a/<key>` is still viewable
**How found:** While reading a public HackerOne report, the researcher followed a GitLab member's link to an internal tracking issue, found an attachment, and noticed the attachment domain served files directly by key.
**Exploitation:** Attacker browses the open attachment directory or harvests keys from public GitLab issues referencing HackerOne reports, then directly requests the attachment URL to retrieve PoC images/videos from private reports.
**Escalation:** Leaked PoCs for unpatched vulnerabilities could be used to exploit those still-unfixed issues.
**Insight:** Attachment/CDN mirrors of bug bounty platforms often skip the platform's authorization; enumerate the storage root and correlate keys leaked in public issue trackers to reach private report media.