Lark Technologies · Report #892049
Stored XSS & SSRF in Lark Docs
Validstatus
criticalseverity
$3,000bounty
178upvotes
5 Feb 2021disclosed
Summary
A stored XSS (cross site scripting) vulnerability was discovered in Lark Docs that could be escalated into a Server Side Request Forgery (SSRF) vulnerability if opened in a headless browser on the Lark server. The vulnerability has been resolved. We thank @mike12 for reporting this to our team and confirming the resolution.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.