Acronis · Report #1265344
Self-DoS due to template injection via email field in password reset form on access.acronis.com
Informativestatus
7upvotes
3 May 2022disclosed
Summary
Self-DoS is possible on https://access.acronis.com due to template injection in password reset form. At the moment, we do not see any security implications as a direct result of this behavior.
How it was found
Summary
HI acronis security team , how are you I hope everyone is OK in the other side of the screen . I found Template Injection in [https://access.acronis.com/reset_password/new] via the mail input .
Steps To Reproduce:
- Open [https://access.acronis.com/reset_password/new] and Enter the mail Payload : sudo_bash{{8*8}}@wearehackerone.com
- After submite the mail , The resulte will Reflect in the page with the mail adress .
Impact
- AngularJs CCTI may lead to xss .