TikTok · Report #2280863
RXSS on TikTok endpoints
Validstatus
mediumseverity
61upvotes
9 Jan 2024disclosed
Summary
A Cross-Site Scripting (XSS) vulnerability was found on two TikTok incentive endpoints, due to the reflection of user-supplied data without appropriate HTML escaping or output encoding. As a result, a JavaScript payload could be injected into the affected endpoint causing it to be executed within the context of a user's browser. We thank @ashrafabdelrazik for reporting this to our team.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.