Tucows (VDP) · Report #3644182
Stored XSS in nameserver field on account settings page
Summary
The reporter has discovered a stored XSS vulnerability in the nameserver field on the account settings page. By intercepting and modifying the PUT request when saving nameserver settings, they were able to inject malicious JavaScript code that executes when the settings page is reloaded. The reporter explicitly notes this is a self-XSS vulnerability, meaning it only affects the account owner who injects the payload and cannot directly impact other users.
How it was found
Summary:
The lack of input validation and weak CSP configuration on the account settings page leads to a stored XSS vulnerability
Steps To Reproduce:
- Go to this address: https://www.████████.com/signin/
- Sign in to your account
- Click on “Settings” in the upper-left corner of the screen
- Click “Edit” next to the “Nameservers” text
- Click “Save Namerservers” without making any changes, and intercept this request in Burp
- Send the request with the HTTP method PUT to Repetar on the Intercept page
- Close Intercept
- Replace any nameserver value in the request you sent to Repetar with this XSS code:
<img/src=x onerror=alert(document.domain)> - Click “Send” on the request in Repetar
- Refresh the page and observe a pop-up opening with
www.████████.comwritten on the screen
Responsible Disclosure:
- The stored XSS vulnerability is found on the account settings page. I was unable to find any evidence of how it could affect other users. This vulnerability could be exploited through account sharing
Supporting Material/References:
- ████████
Impact
This stored XSS vulnerability allows injection of JavaScript code that executes in the context of the ████████.com domain when visiting the nameserver settings page.
Self-XSS Limitation: The vulnerability is limited to a self-XSS scenario - only the account owner who injected the payload can see and be affected by the XSS execution when visiting their own account settings page. Other users cannot access or view another user's account settings page.
Limited Security Impact: Due to the self-affecting nature:
- No direct impact on other users or accounts
- Cannot be used to attack other ████████.com users
- Requires the attacker to compromise their own session/account
Potential Scenarios: The primary security concern would be in limited scenarios such as:
- Shared computer environments where multiple users access the same ████████.com account
- Social engineering attacks where a user is tricked into injecting malicious code into their own account
- Demonstration of inadequate input validation that could indicate broader security issues
Technical Significance: While the practical impact is minimal, this demonstrates a lack of proper input validation and output encoding in the nameserver configuration functionality, which represents a security weakness in the application's handling of user input.