TGViewer
Hackerone Reports Hackerone Reports @hackeronereports · 242 subscribers
Post #783 62
🎯 New Report #3694007: Authenticated Elasticsearch Painless script execution via Query.search.sort query on hackerone.com/graphql
🔺Severity: High
👽 Reporter: brumbelow
⭐️ Reputation: 753
🛠 State: resolved
💼 Team: HackerOne
💵 Bounty: 7000
🕐 Submitted: 2026-04-24
⏰ Disclosed: 2026-06-17 14:17:26
📝 Summary: The GraphQL query on hackerone.com/graphql allowed authenticated users to execute arbitrary Painless scripts through the sort query argument, without server-side validation or allowlisting. This was confirmed by submitting requests with different Painless script payloads, and observing that the script's return value determined the document ordering in the search results.
📂 Report JSON File: 3694007
@hackeronereports
Open in Telegram All posts from @hackeronereports
More from @hackeronereports
  1. Oct 16, 2026🎯 New Report #3730301: SQL Injection vulnerability found on IBM.com subdomain 🔺Severity:…
  2. Oct 16, 2026🎯 New Report #4028616: Memory exhaustion (DoS) via unbounded file read in `EncodingDiscov…
  3. Oct 15, 2026🎯 New Report #3972760: Open redirect on app.hey.com bypasses HEY desktop's internal-origi…
  4. Oct 15, 2026🎯 New Report #3972558: Burp Suite OpenAPI Event Log HTML injection triggers Windows SMB a…
  5. Oct 15, 2026🎯 New Report #3938927: An organization admin can create an attacker-controlled organizati…
  6. Oct 15, 2026🎯 New Report #3770768: [Switch Remote stack buffer overflow in the LDN/LP2P DHCP server l…
Threads Profile ViewerView any public Threads profile without an account.Open ThreadLook →Writing with AI? Make it sound human.Metric37 rewrites AI drafts so they read naturally. Free AI detector, 1,500 words free.Try Metric37 →