u/86_Dishwashers

I submitted a bug report through BugCrowd 3-4 months ago and I received the generic rejection email. The bug in question was discovered thru a link from my real estate agent (I’m selling a house). Details below (exactly as I submitted):

—

Hi Zillow,

For context, I am a software developer who is selling a house.

My real estate agent sent me a text message with a link to tell me that I have an upcoming home inspection.

Her link was a short URL in the form of: 
https://showingti.me/sAmplIng

The shown URL above is a fake sample URL that matches the number of characters and character capitalization in the URL provided by my agent.

Upon clicking her link, I was shown the “Appointment Details” page with the exact URL: 
https://showingti.me/MobileV2#/activitiesApp/activityDetails

From there, I was able to click the hamburger menu at the top-left and I was presented a view that showed my agent’s name, profile picture, their listings (shown as “My Listings”), and other options including a gear icon which took me to the “My Profile” page where I could change the email address and password to the account.

I was even presented an option to upgrade the account. I could also read the agent’s “Conversations” inbox.

In summary, via a simple innocuous link to show appointment details, I was effectively logged into my agent’s account and given the ability to change her login details and read her inbox.

For the record, I did not change her login details, and I did not attempt to read her inbox so I do not know if I could actually perform those actions, but the fields to change her login details were editable and enabled the “Save Username/Password” button.

The username is actually an email address, so I believe I would actually have the opportunity to lock her out of her account assuming there were no other account protection steps such as 2FA or Email Approval.

I am submitting my findings as a bug bounty.

For the bug bounty reward, I am looking for immediate financial compensation that is appropriate for a high CVE.

Additionally, I would like to recommend my professional software development services because I believe I can write better software than what I have unfortunately seen.

I recommend making a day zero patch and temporarily shutting down public access to the website before more details are compromised (e.g., credit card details on an upgraded account).

—

I’ve been working 80-90 hour weeks for a startup for the past month and I don’t think that will change so I don’t have the energy or time to chase this down, so I’m putting them on blast here.

I don’t have a reproducible link (maybe this is what BugCrowd triagers / AI assistants were asking for but they should’ve been explicit).

Do with this info what you will. Screenshots attached.

This is a follow up to:

https://www.reddit.com/r/bugbounty/s/13KBKwd7Ul

Sorry for the delay, I was going to debate on what I want to do before blasting them on Reddit but I haven’t had any time or energy to think about this. Feeling burned out and tired and done with this world so here goes nothing.