Semrush · Report #752042
Content Injection on api.semrush.com to Reflected XSS
Validstatus
lowseverity
16upvotes
2 Apr 2020disclosed
Summary
The researcher found XSS vulnerability and wrote an awesome summary! :)
While testing api.semrush.com I've found that some inputs triggered MongoDB error on /reports/v1/projects/:id/siteaudit/page/list endpoint. Contents of url parameter was reflected in error message. Unfortunately WAF blocked my XSS attempts. Fuzzing a little bit further I was able to bypass WAF with <object data=javascript:confirm(document.domain)> payload.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.