TikTok · Report #1683129
XSS at TikTok Ads Endpoint
Validstatus
highseverity
60upvotes
27 Jan 2023disclosed
Summary
A Cross-Site Scripting (XSS) vulnerability was found on a TikTok Ads endpoint, due to a lack of appropriate HTML escaping or output encoding on the reflection of user-supplied data, which was resolved on September 7, 2022. This could have resulted in a JavaScript payload injected into the endpoint causing it to be executed within the context of the victim's browser. We thank @s3c for reporting this to our team.
I found a Cross-site scripting (XSS) and bypassed the WAF (akamai) on one of the TikTok ads endpoints and could lead it to takeover any account on ads.tiktok.com
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.