Semrush · Report #723707
Code injection in https://www.semrush.com
Validstatus
mediumseverity
22upvotes
1 Nov 2019disclosed
Summary
During the internal investigation, we have found ways to perform XSS attack using this vulnerability.
How it was found
INTRODUCES:
-With a direct error on the homepage, it is easy to trick the victim into accessing a fake page from the attacker
STEP:
Step: Send url with payload to victim: https://www.semrush.com/marketplace/%22%0D%0A/%3E%3Ch1%3E%3Ca%20href%3Dhttps://evil.com%3EYour%20password%20is%20currently%20unsafe,%20please%20click%20the%20link%20to%20update%20the%20information%3C/a%3E%3C/h1%3E/
==> Victim enter link and open redirect to evil.com , Attacker can phishing to Retrieve user information.
FIX:
-Whitelist -Filter "<"
Impact
- Fake notification.
- Open redirect