Stored XSS on https://events.hackerone.com

Summary

@nagli found a stored Cross-Site Scripting vulnerability in a 3rd party vendor that was used by HackerOne. This system did not contain any data related to reports submitted and stored on hackerone.com. HackerOne worked with the vendor to remediate the vulnerability. The report is partially disclosed to anonymize the vendor.

This vulnerability is part of a study I have been conducting about "Vulnerability inheritance - Attacking companies and scoring bounties through 3rd party integrations". events.hackerone.com was pointing towards a 3rd party vendor as a CNAME, I managed to find authenticated stored XSS on an endpoint which belongs to the vendor which allowed me to achieve RXSS through CSRF+Self XSS on Hackerone's subdomain.