TikTok · Report #1433125
Cross site scripting via file upload in subdomain ads.tiktok.com
Validstatus
lowseverity
$500bounty
65upvotes
25 Jan 2022disclosed
Summary
A file upload XSS (cross-site scripting) vulnerability was found in TikTok ads ticketing platform. Due to missing checks it was possible to upload .svg files which contained XSS payload. We thank @blubluuu for reporting this to our team and confirming its resolution.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.