Reflected XSS due to vulnerable version of sockjs
Medium
A
Automattic
Submitted None
Actions:
Reported by
chip_sec
Vulnerability Details
Technical details and impact analysis
## Summary:
There is reflected XSS on *.simperium.com. The bug exists due to a vulnerable version of sockjs library.
## Platform(s) Affected:
simperium.com
js.simperium.com
## Steps To Reproduce:
1. Visit https://simperium.com/sock/1/0/0/0/htmlfile?c=alert('XSS')//
2. You will see an alert message because of executed JS
## Impact
XSS may be used by an attacker to perform a lot of things, for example, to steal user session
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Submitted
Weakness
Cross-site Scripting (XSS) - Reflected