Insulet Corporation · Report #1073725
DOM XSS on www.omnipod.com/freedom/birthdate-confirmation and www.omnipod.com/pif/thanks-freedom
Validstatus
mediumseverity
61upvotes
13 Sept 2025disclosed
How it was found
Summary:
DOM based XSS was found on multiple pages (and may exist on still more pages)
Steps To Reproduce:
- Navigate to the following URL: https://www.omnipod.com/freedom/birthdate-confirmation?sid=a1t2J000005vUzlQAE&#'onload='alert(document.domain)
- Observe alert box appears containing the domain from which the injected script is executed. NOTE: The value of the sid parameter does not seem to matter for this vulnerability
OR
- Navigate to the following URL: https://www.omnipod.com/pif/thanks-freedom?&#'onload='alert(document.domain)
- Observe alert box appears containing the domain from which the injected script is executed.
Supporting Material/References:
There are two screenshots attached that demonstrate these vulnerabilities
This appears to be the vulnerable script:
<script> var loc = window.location.toString(); var params = loc.split('?')[1]; //var srcstring = "https://na-sandbox.myomnipod.com/test-lic-p4-proc?" + params; var srcstring = "https://na.myomnipod.com/lic-p4-proc?" + params; document.write("<iframe id='frame' name='frame' src='" + srcstring + "' width='950'></iframe>"); </script>Impact
An attacker could use Cross-Site Scripting to modify the appearance of the site to deface it, to log user keystrokes, to create forms on your site which request confidential information that is then sent to the attacker, or even hijack user sessions.