Stored XSS & SSRF in Lark Docs Analysed #892049 Valid Server-Side Request Forgery – 2021-02-05 $3,000 178 Server Side Request Forgery #644238 Valid Server-Side Request Forgery – 2021-03-29 – 164 Full read SSRF via Lark Docs `import as docs` feature #1409727 Valid Server-Side Request Forgery – 2022-01-28 $5,000 124 Attacker is able to join any tenant on larksuite and view personal files/chats. #1363185 Valid Access Control – 2021-11-03 – 84 SSRF with information disclosure #810401 Valid Server-Side Request Forgery – 2021-04-27 – 64 [Lark Android] Vulnerability in exported activity WebView #694053 Valid Cross-site Scripting – 2021-07-22 $1,000 63 Able to steal private files by manipulating response using Compose Email function of Lark #1373784 Valid Insecure Direct Object Reference – 2022-01-25 – 50 Reflected xss and open redirect on larksuite.com using /?back_uri= parameter. #955606 Valid Cross-site Scripting – 2022-01-13 – 49 Non privileged user is able to approve his own app himself leading to mass privilege escalations. #1168475 Valid Access Control – 2021-11-20 – 45 Sensitive information of helpdesk is being leaked. #805023 Valid Access Control – 2021-03-06 – 45 Accessing/Editing Folders of Other Users in the Orginisation. #1025881 Valid Access Control – 2022-10-29 – 42 Improper Access Control allows OTP bypass #1948506 Valid Access Control – 2023-10-25 – 40 [IDOR] Modify other team's reminders via reminderId parameter #946323 Valid Insecure Direct Object Reference – 2022-01-13 – 40 Able to steal private files by manipulating response using Auto Reply function of Lark #1387320 Valid Insecure Direct Object Reference – 2022-01-25 – 39 RPC Implementation allows unauthenticated remote calls #876022 Valid Cross-site Scripting – 2021-02-10 $1,250 39 Improper generating of access link at go.larksuite.com leads to access to other organizations/users' private data #785577 Valid No weakness recorded – 2021-02-27 – 33 [CSRF] No Csrf protection against sending invitation to join the team. #728199 Valid Cross-Site Request Forgery – 2022-10-20 – 30 Stored XSS in Satisfaction Surveys via "Ask Reason for Dissatisfaction" option #953791 Valid Cross-site Scripting – 2021-02-23 – 29 Improper Access Control on Lark Footer Feature #1169340 Valid Access Control – 2021-05-18 – 28 Hyper Link Injection while signup #864751 Valid Input Validation and Logic – 2021-01-03 – 28 Privilege Escalation to All-staff group #1021460 Valid Access Control – 2022-10-28 – 26 Users Without Permission Can Download Restricted Files #794904 Valid Access Control – 2022-10-18 – 25 Normal User is able to EXPORT Feature Usage Statistics #1470076 Valid Access Control – 2022-03-04 – 21 Access to private file's of helpdesk. #804534 Valid Access Control – 2022-10-18 – 21 User with single department permission can view applicant list of all department's #877300 Valid Access Control – 2021-03-03 – 20 Stealing app credentials by reflected xss on Lark Suite #791278 Valid Cross-site Scripting – 2021-02-26 – 19 Removed user can still view comments on the file/documents. #1335070 Valid Access Control – 2022-10-20 – 18 Stored xss on helpdesk using user's city #971857 Valid Cross-site Scripting – 2022-01-14 – 18 Ability to View Non-Permitted Admin Log #1533220 Valid Access Control – 2022-10-20 – 17 Viewer is able to leak the previous versions of the file #1080700 Valid Access Control – 2022-10-24 – 17 IDOR Allows Viewer to Delete Bin's Files #1074420 Valid Access Control – 2022-10-24 – 16 Messages disclosure via search feature of other users group(Cross-Tenant). #912161 Valid Insecure Direct Object Reference – 2021-03-17 – 15 Stored xss in larksuite internal helpdesk and other user's helpdesk. #884931 Valid Cross-site Scripting – 2021-02-19 – 13 [AWC-Pune] - User can download files deleted by Admin using shortcuts #1463028 Valid No weakness recorded – 2022-02-25 – 11 In orginization stored xss using location (Larksuite survey app) #998138 Valid Cross-site Scripting – 2022-01-14 – 11 Sub-Dept User Can Add User's To Main Department. #890209 Valid Access Control – 2022-10-18 – 10 Reflected XSS on Lark Suite #700726 Valid Cross-site Scripting – 2021-03-19 – 10 Server Side Request Forgery #659565 Valid Server-Side Request Forgery – 2021-03-18 – 9