HexBrain

HackerOne · Report #189726

Websites opened from reports can change url of report page

Validstatus
mediumseverity
50upvotes
25 Feb 2017disclosed

How it was found

This issue is similar to #124889, but it is only exploitable via MS Edge or Internet Explorer 11

Proof Of Concept: Clicking on a link set to "http://d214mfsab.org/same.html" (including this one) will change the still-open report page to http://example.com. This works on current versions of MS Edge and Internet Explorer 11.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original