Lark Technologies · Report #791278
Stealing app credentials by reflected xss on Lark Suite
Validstatus
mediumseverity
19upvotes
26 Feb 2021disclosed
Summary
A reflected cross-site scripting (XSS) vulnerability was found on a Lark Suite endpoint via the 'next' parameter which an attacker could have potentially used to obtain app credentials (must first know the app ID). We have resolved this issue and thank @imran_nisar for reporting this to our team.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.