Slack · Report #2926

Stored XSS

Validstatus

4upvotes

6 Apr 2014disclosed

How it was found

Hi,

Go to this URL https://sehacure.slack.com/account/preferences?updated_highlight_words=1 and in the highlight words option please fill the XSS vector as

</textarea><script>prompt(document.cookie);</script>

Your cookie will be reflected.

Best regards, Anand

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original