Open
Description
header.tag appears to be vulnerable to XSS here:
// get the info of the current user, if available (null otherwise)
function getUserInfo() {
return ${userInfoJson};
}
userInfoJson is included in the page and is not encoded so malicious elements could be created. If the string </script> appears in userInfoJson, the <script> element will be closed
and a new malicious <script> can be created:
// get the info of the current user, if available (null otherwise)
function getUserInfo() {
return {"sub":"12318767","name":"Test</script><script>alert(1)</script> Test","preferred_username":"Test","given_name":"Test</script><script>alert(1)</script>","family_name":"Test","email":"[email protected]","email_verified":true};
}
And the malicious JavaScript is executed:
Metadata
Metadata
Assignees
Labels
No labels