ThisData · Report #72526
Xss via Dropbox
Validstatus
1upvotes
7 Mar 2016disclosed
Summary
ThisData (formerly Revert) provides the ability to backup Dropbox files. File names were rendered within the app in an unescaped manner, meaning if you could get Dropbox to accept a file with a name like "><img src="x" onerror=alert(cookie)>.png you could XSS Revert's backup rendering screen.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.