TikTok · Report #2251191
RXSS via region parameter
Validstatus
mediumseverity
47upvotes
9 Jan 2024disclosed
Summary
A Cross-Site Scripting (XSS) vulnerability was found on a TikTok endpoint via the 'region' parameter, due to the reflection of user-supplied data without appropriate HTML escaping or output encoding. As a result, a JavaScript payload could be injected into the affected endpoint causing it to be executed within the context of a user's browser. We thank @ashrafabdelrazik for reporting this to our team.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.