TikTok · Report #1890284
Unrestricted File Upload on https://partner.tiktokshop.com/wsos_v2/oec_partner/upload
Validstatus
mediumseverity
118upvotes
12 Apr 2023disclosed
Summary
An unrestricted file upload vulnerability was found on a partner.tiktokshop.com endpoint, where if the content-type in the header was changed, any extension could be uploaded. We thank @h4x0r_dz for reporting this to our team.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.