Subject: Re: Vulnerability Report-Broken Authentication
From: Daniel joseph <[email-masked]>
To: [email-masked]
Date: Tue, 30 Apr 2024 03:42:10 +0500

Hi,

Can I have an update regarding the bounty for the reported vulnerability?

On Sun, Oct 1, 2023 at 12:13 AM Daniel joseph <[email-masked]>
wrote:

> Hi Team,
>
> I hope you are well. I've reported a security vulnerability on your
> website a long time ago and still haven't heard back from you. I'd really
> appreciate it if you can verify my findings and update me regarding the
> bounty for the report.
>
> Looking forward to hearing from you.
>
> On Tue, Feb 28, 2023 at 10:57 PM Daniel joseph <
> [email-masked]> wrote:
>
>> Hi Team,
>>
>> I believe that you have had an opportunity to read our previous email
>> regarding the vulnerability report. As it's been long already and your team
>> hasn't responded to the vulnerability report submitted by me, I was
>> expecting $500 for responsible disclosure of vulnerability.
>>
>> Furthermore I would like to publicly disclose vulnerability reports on
>> our blogs for research and educational purposes. If you have any concerns
>> do let me know.
>>
>> Regards,
>> Daniel
>>
>>
>> On Thu, Dec 8, 2022 at 12:49 PM Daniel joseph <
>> [email-masked]> wrote:
>>
>>> Hi Team,
>>>
>>> Any update regarding the report and bounty?
>>>
>>> On Fri, Oct 21, 2022 at 11:28 PM Daniel joseph <
>>> [email-masked]> wrote:
>>>
>>>> Hey Team,
>>>>
>>>> I'm a penetration tester and bug bounty hunter. I have found a
>>>> potential vulnerability in the site. Please review the report below.
>>>>
>>>> Vulnerability: Broken Authentication & Session Management
>>>> We have observed that when we change "password" from one browser in
>>>> place of session expiration from another browser it just updates the
>>>> password from another browser and the old session gets updated without
>>>> being logged out. The flows goes like this:
>>>> Broken Authentication and Session Management > Failure to Invalidate
>>>> Session > On Password Change
>>>> Steps:
>>>> 1- Login from two browsers at a time [From Chrome browser and from
>>>> Mozilla Firefox].
>>>> 2- Change password in settings from chrome browser.
>>>> 3- Now Check Mozilla Firefox.
>>>> 4- Your Session got "updated" in place of expiration.
>>>>
>>>> Same goes with when using two different computer systems.
>>>> 1- Login from two computers at a time
>>>> 2- Change password in settings from computer A.
>>>> 3- Now Check computer B.
>>>> 4- Your Session got "updated" in place of expiration.
>>>>
>>>> Recommendations: If Session is Updating from one Browser/Computer so
>>>> other should expire first to renew session after login.
>>>>
>>>> If you require any additional information, please let me know. I'll be
>>>> waiting to hear from your side regarding the report and bounty.
>>>>
>>>> --
>>>> Regards,
>>>> Daniel
>>>>
>>>
>>>
>>> --
>>> Regards,
>>> Daniel
>>>
>>