Stored XSS Vulnerability in H1C Private site



Hello Friends,

Recently, I found an interesting stored XSS vulnerability in private site. 

It was not easy, means difficult to exploit.


The private site has a feature which allows users to create or start email campaign for email marketing.

 After login to the website account, I just started email campaign and send an email from my website account to my personal email address.

 Next, I received that email(send via campaign) to my personal email, I just reply to that email.

 The reply was received in my account inbox of that website.

 So, I try to reply or send an email with html tag like Hello <b>Hack</b> but I received the same reply Hello<b>Hack</b> in inbox of that website account.

Next, I understand that we can't send HTML scripts from Gmail, Yahoo mail etc.

So, I just copy that 'reply email' and visit fake email sender and send an email in HTML and I received that message in inbox of website account and the HTML scripts got executed.

 I try to find XSS vulnerability and send mutliple XSS payloads but my scripts was not executed.

 I believed that it's vulnerable to XSS but my scripts was not executing.

Finally, I found the payload
 
<img src="/" =_=" title="onerror='prompt(1)'">


I just send an email from fake email sender to copied 'reply email' with the above payload, the script got successfully executed in my account inbox of that site and XSS fire in Firefox browser.

I know it's very complex and difficult to understand.
 




Attack Scenario:
 
Victim login to his account, creates or starts Email Campaign means start Email Marketing and send to no. of emails.
Attacker receives an email and click on reply and copy the 'reply email' then attacker visits fake email sender and send email or reply with malicious scripts to that email through fake email sender.
When Victim login to website account and visits the inbox, malicious scripts got executed.








I reported this finding, they accepted my report and rewarded me a $900 bounty.

Apologies for typo errors and mistakes.



That's all Folks!

Comments

Post a Comment

Popular posts from this blog

XSS like a Pro

Image
Hello Friends, I'm gonna share my interesting finding here. Recently,  About two months ago,  I received a private invitation on Bugcrowd and the next day I started to look for bugs on that website because there was only one target (testing site) in scope and they provided me some credentials. I can't disclose the site name, so let's assume https://redacted.com First of all, I logged-in to that site (redacted.com) with the provided credentials and inspected the site around 15 minutes and tried to understand it. After that, I started to look for bugs and found multiple bugs mostly stored XSS. At that day, I had found a total 11 vulnerabilities. I reported them and received a bounty on each report. So, I'm not disclosing the bounties. Also, I'm not sharing my all findings but some. So,  At the beginning, I tried to change my default password and successfully changed my password to '1' which was the first bug that there is no password policy.
Read more

Email Spoofing for Beginners

Image
Hello Everyone, Greetings to all, In this article, I'll talk about email spoofing in a little depth. So, First of all What is Email Spoofing?  If you already know about email spoofing then congratulations But don't worry if u don't know about email spoofing. Email spoofing is a tactic used in phishing and spam campaigns because people are more likely to open an email when they think it has been sent by a legitimate source. It's not a new technique. It's a very old technique and still widely used in phishing and scamming. This article is going to be interesting and I'll try to short this long article as much simple as possible. Recently, my friend ask me How it's possible to spoof an email? So, there are a lot of questions related to this issue.  When a Domain is Spoofable? It is just as simple in an email as well because email protocols (SMTP) lack authentication. Anyone with a little basic knowledge can able to send an email wit
Read more

DoS on WAF Protected Sites by Abusing Cookie

Image
Hi Folks, Today, I'm gonna share one of my interesting finding in bug bounty. I occasionally hunt bugs in bug bounty in my free time. So, I don't have enough time to blog. But on someone request, I share some of my bug bounty findings here. I like to find some interesting and logical bugs. Recently, I found an interesting bug in many sites but I can't disclose the name of every website, one website 'Upwork' already patched this bug and resolved the report that's why I disclose the name. So, what's the bug?   Denial of Service (DoS) > Single user cookie based DoS There are a lot of websites using WAF like Cloudflare etc. When the Cookie sets with malicious characters(like"><script> alert(1)</script> mean  with XSS or SQLI payloads etc.) value, the site WAF like Cloudflare block us from accessing that website, we need to remove that cookie to access the site Many websites sets 'Referrer'
Read more