Revive Adserver · Report #4116433
Stored XSS in report date selection
Summary
Description
HackerOne community member Matías López Pereira (HackerOne: @mlopez01) has reported stored XSS in the date-selection controls of standard reports. A crafted period_preset value could be saved in the victim's session and inserted into JavaScript without appropriate encoding. An attacker could supply a report URL retained through normal reauthentication; the payload could then execute on the initial report and subsequent report views using the stored defaults.
Resolution
Date-selection values are now encoded with JSON encoding appropriate for their JavaScript context. The same encoding has also been applied to the audit date-selection field.
Security advisory
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.