DuckDuckGo · Report #483774
XXE on https://duckduckgo.com
Validstatus
criticalseverity
218upvotes
31 Jan 2019disclosed
Summary
An XML External Entity (XXE) injection vulnerability was discovered in the x.js endpoint on https://duckduckgo.com via u parameter. This was due to improper sanitation of external XML entities. The results was a leak of certain world readable files on the system.
This issue was patched. Additionally, we intend to retire the endpoint in the very near future.
Big thanks to @mik317 for reporting this issue!
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.