X.509 certificate validation fails on international vanity domains

Disclosed: 2017-02-06 22:49:20 By tk0 To yelp
None
Vulnerability Details
This is not an vulnerability, more likely TLS/SSL related configuration issue with certificates noticed during bug bounty testing. If you try to access any Finnish domain (such as my HackerOne test-profile http://tomitest.yelp.fi/), there will be an certificate related error presented to user. You can try with any other Finn URL's and you'll notice this affects all other too. Most probably users are not able to access Finnish Yelp domain pages without some extra hassle/confusion. Basically *.com* works fine, but *.fi* doesn't. Anyways, since Yelp provides *.fi* domain if you're are an Finn (like me), I assume both should work for user profiles. I've added two screenshots to aid this finding: 1. Certificate error presented by Google Chrome. 2. Link from my testpage (Yelp's localized profile page address via get your own url) Cheers, -Tomi
Actions
View on HackerOne
Report Stats
  • Report ID: 180538
  • State: Closed
  • Substate: resolved
  • Upvotes: 7
Share this report