HTML Escaping Error in the 404 Page on developer.uber.com/docs/
Unknown
Vulnerability Details
There is a non-exploitable HTML escaping error in the 404 page on developer.uber.com. When loading ```https://developer.uber.com/docs/test'test```, the following HTML is rendered:
``` html
<a href="/docs/test" test'="" require-login="">logging in</a>
```
Note that the injected ```'``` is rendered in the HTML as a closing ```"``` that closes the href= section. Sadly, I have been unable to find any way of exploiting this because when I inject an ```=``` (in order to inject ```onmouseover=alert(0)```), it is rendered as ```%3d``` which prevents me from obtaining javascript execution. Injecting a ```>``` to close the tag also does not work.
So I'll admit that this is not a high priority vulnerability, but I still believe that it should be fixed since it allows for the user to inject limited content into a ```<a href```.
Thanks,
David Dworken
Actions
View on HackerOneReport Stats
- Report ID: 125130
- State: Closed
- Substate: resolved
- Upvotes: 2