Automattic · Report #920005
Stored XSS on app.crowdsignal.com + your-subdomain.survey.fm via Embed Media
Validstatus
mediumseverity
96upvotes
18 Nov 2020disclosed
Summary
If you want to follow me, here is my linkedin & twitter accounts: https://twitter.com/alicanact60 https://tr.linkedin.com/in/alicanact60
@mygf
How it was found
Hello there, I found a stored xss vulnerability.
Steps:
- Go to
https://app.crowdsignal.com/dashboard - Create a quiz.
- Go to
https://app.crowdsignal.com/quizzes/{your-quiz-id}/question - Add
Multiple Choice - Put a name to answer 1.
- Click Add media button.
{F901543}
7. Select Embed Media
8. Paste this: [wpvideo w0MiG12E]
9. Insert it.
10. Open Burp Suite and click Save button.
11. Return to burp suite and paste this payload to media[23168664] parameter: [wpvideo%20w0MiG12Exx1\"><svg/onload=prompt(document.domain)>]
12. Forward the request and refresh the page. You will see xss alert.
Also go to https://app.crowdsignal.com/sharing/quiz/{your-quiz-id}/ and copy survey.fm link. Go to it and you will see xss alert.
Impact
Stealing cookies
Regards, @mygf