TikTok · Report #2306491
Stored-XSS-ads.tiktok.com
Validstatus
lowseverity
310upvotes
2 Oct 2024disclosed
Summary
A stored cross-site scripting (XSS) vulnerability was found on a TikTok Ads endpoint, making it possible for MP4 video files, or files with HTML or JS code to be executed in a user's browser. We thank @ahmed_xyz for reporting this to our team and confirming its remediation.
A Stored Cross-Site Scripting (XSS) vulnerability was found through the video upload function. Due to the lack of necessary checks, it was possible to upload MP4 video files and XML files containing HTML and JavaScript code, leading to their execution within the victim's browser.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.