Stored XSS on TikTok's backend leads to the leakage of highly sensitive administrator data (Cookies, API Keys, Internal Paths, Emails, phone numbers).

Summary

A stored cross-site scripting vulnerability was found in TikTok's contact form backend. When malicious code was submitted through the form, it executed when administrators viewed the submission, exposing sensitive internal data. The vulnerability was classified as Medium severity due to the complex conditions required for exploitation

A Critical Blind Stored Cross-Site Scripting (XSS) vulnerability was found through injection of a malicious payload into a publicly accessible partner application form used by TikTok’s influencers, agencies, and content creators. The injected payload was silently stored and later propagated into TikTok’s internal administrative systems, specifically within an internal big data analytics environment (Dorado / DataLeap) restricted to privileged employees.

After several months, the payload was unintentionally triggered when a privileged internal employee accessed and reviewed the submitted data through an internal browser-based data analytics tool integrated within TikTok's backend infrastructure. This resulted in unauthorized execution of untrusted JavaScript code directly within a highly sensitive, closed administrative environment running in the employee's browser session.

The execution led to the exposure of highly sensitive internal data, including employee session tokens, administrative JWT credentials, and (PII), internal project identifiers, user search records, and detailed information about TikTok’s internal data analytics architecture, and Backend — clearly demonstrating the significant risks associated with unfiltered external input traversing into secured backend systems.

WriteUp : https://medium.com/@ahmed_xyz/18c433f49d91