X / xAI · Report #1207040
Blind XSS on Twitter's internal Big Data panel at █████████████
Validstatus
criticalseverity
357upvotes
9 Jul 2021disclosed
Summary
An attacker appears to be able to send an XSS payload to Twitter staff members, using a Support Form. This XSS payload will execute in the context of an internal subdomain, allowing it to exfiltrate sensitive internal Twitter information.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.