stored XSS (angular injection) in support.rockstargames.com using zendesk register form via name parameter

Summary

In this report, the researcher discovered that registering for our Support site using the Zendesk Registration Form allowed for entering an AngularJS Template Injection payload as the Username. This could have allowed an attacker to perform Stored XSS attacks or similar. We deployed a fix for this issue along with a large site update that also resolved other known vulnerabilities.