Coinbase · Report #315865
Stored CSS Injection
Validstatus
15upvotes
2 Apr 2018disclosed
Summary
When creating a product, users can upload a logo. The logo_url was not escaped properly, allowing an attacker to inject malicious characters into a style tag.
This vulnerability did not allow for XSS due to our CSP, however, it did allow for CSS injection.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.