
How I could have read your confidential bug reports by simple mail?
Hey Everyone, Hope you’re doing safe and sound.
I have recently found a bug in the Microsoft research portal which could have let me read the bug report updates of fellow security researchers who report to Microsoft, this was a simple yet interesting thing I found while I was randomly exploring it.
What was the bug?
It was an information disclosure bug, Which discloses information of the report updates by having the vulnerability report ID.

How to get the vulnerability report ID?
The vulnerability report ID is VULN-<Some number>. This is the unique identifier for every report. Microsoft validates the bug report by this ID. For every bug report, they give an ID which is a number like 010001 followed by 010002, which is easily guessable.
How to reproduce the bug?
- Report a bug from User A.
- Send a mail from User B’s mail ID to Microsoft’s vulnerability report mail ID, saying some info with the subject line of VULN-<the report number>
- Now, User B is added to the ticketing portal of Microsoft.
Now, User B can receive updates of User A’s Bug report without his knowledge.
How the bug could have affected Microsoft?
If the attacker sends an automated mail by changing the report number to Microsoft’s mail ID then he could have listened to the bug report updates. If any sensitive information is sent via mail, then the attacker can use it for any malicious purposes.

This bug was assigned as Important by Microsoft and fixed it. This was not awarded bounty because it was out of scope as per the Microsoft terms.
Thanks for reading, good day! :-)
Timeline:
Bug reported on 01/07/2021
Bug assigned on 21/07/2021
Sent to the development team on 16/09/2021
Bug fixed on 21/10/2021
Note: This blog was approved by Microsoft
Follow me on:
Instagram: https://www.instagram.com/sudhakar_._m/
Facebook: https://www.facebook.com/sudhakarmuthumani00
Twitter: https://twitter.com/Sudhakarmuthu04
🔈🔈Infosec Writeups is organizing its first-ever virtual conference and networking event. If you’re into Infosec, this is the coolest place to be, with 16 incredible speakers and 10+ hours of power-packed discussion sessions. Check more details and register here.