Summary

@bugdiscloseguys reported an issue to us leading to a stored XSS attack on the iOS app. To be exploitable the victim would have to open a malicious file shared by an adversary with the user.

On request of the reporter, this issue is only disclosed limitedly. While we usually don't agree to disclose limited in this case the report was submitted prior to our policy change about disclosure.

Original report

Hey there After a long time i finally was able to find a bug. So When Someone upload html file it does not render it neither on web nor on android app. What happens is when someone opens html file on IOS app the file actually renders . Though i have not tested it fully i was able to execute xss due to sickness :( So When Someone uploads a malicious file and click on HACK xss popups. And The other thing i wanted to mention is that due to rendering of HTML an attacker can even create a FAKE LOGIN FORM and shared it with victim and can capture credentials. Though i am not good at programming i haven't done much sorry about that. POC File attached with POC of xss. Thanks :)

Proof of concept

<a href="data:text/html;base64,PHNjcmlwdD5hbGVydCgiWFNTIik8L3NjcmlwdD4=">hack</a>