Path Traversal on map.prezi.com ($1,000)

21 May 2014 1 min read Patrik Grobshäuser Archive

Research summary

A path traversal issue on Prezi's map.prezi.com subdomain, fixed within two days of reporting and rewarded with a $1,000 bounty.

Products: Prezi
Vulnerability: Path traversal, Information disclosure
Bounties: $1,000

Published in 2014. Product behaviour and tooling described here reflect that time.

Short story: I discovered a path traversal issue on one of Prezi’s domains, map.prezi.com.

Proof of concept
#

Disclosure
#

Timeline: mail received 05/18/2014 21:01:00 — fixed 05/20/2014

The reply from Prezi’s security team:

Hi Patrik,
Thanks again for your submission, you were the first to report this issue and we deployed our fix, therefore you are eligible for a $1000 reward. Congrats!
We would like to ask for the following details for the payment: (bank details request omitted)
Thanks and congrats again!
Attila

Hats off to the great Prezi Security Team!