THIS LITERALLY JUST POPPED UP OUT OF THE BLUE AND IVE LAUGHED SO HARD THAT MY LUNGS HURT
Hello,
We have assessed this case as Low Impact which is not eligible for bounty. You are eligible to be acknowledged from the CVE that will fix this case.
Kind regards,
Jim
MSRC
i did not have high hopes for a bounty but low impact? come on that's just insulting
mind you, this vuln can get you access to like 20 permissions that you should only get with the user's consent. low impact my ass lmao
i wish i could share this here because i am actually close to going feral over this.
the low impact assessment is somewhat right, at least in their eyes, because they have a fucking fundamental misunderstanding of fucking web security
in fairness, i cant leak the full context, but essentially they think that a vuln that can be triggered via JS/HTML REQUIRES PHYSICAL ACCESS TO THE VICTIMS MACHINE.
I WISH I WAS FUCKING JOKING
i can't share the exact details without leaking parts of the vuln itself so im gonna have to make a followup to this once it got fixed but JESUS FUCKING CHRIST HOW FUCKING DENSE ARE THEY
if you are using edge: please switch browsers immediately, their security team is full of amateurs. i am not joking, please stay as far away from it as possible
edit: for context for the last paragraph, this apparently went through several people and nobody noticed it (if the msrc guy did not lie to me).
read full email exchange (yes msrc does not use the fucking msrc portal but emails security researchers lol)
from MSRC:
Hi ,
Here's an update on your case:
MSRC Case [censored]We confirmed the behavior you reported. We'll continue our investigation and determine how to address this issue.
Please let me know if you have additional information that could aid our investigation, or if you have questions.
Thanks!
J
MSRC
from MSRC:
Hello,
We have assessed this case as Low Impact which is not eligible for bounty. You are eligible to be acknowledged from the CVE that will fix this case.
Kind regards,
Jim
MSRC
from me:
Hey there, may I ask why this is only Low Impact? This can easily lead to [censored], and can leak a lot of sensitive data. For example, a similar bug on Chromium BBP (which I think can be compared to the Edge BBP, both are for major browsers after all) that abuses the same underlying issue [censored] got rated as High Impact and got bountied: [censored]. Would be nice if someone could look into this again.
from MSRC:
Hello,
We have examined this issue several times and the assessment is low impact because an attacker must have local access to the machine.
I hope this helps?
Kind regards,
Jim
MSRC
emphasis on "We have examined this issue several times". holy fucking shit
