[accounts.reddit.com] Redirect parameter allows for XSS
High
R
Reddit
Submitted None
Actions:
Reported by
dvorakxl
Vulnerability Details
Technical details and impact analysis
## Summary:
Hello team! I was tampering with the dest parameter in accounts.reddit.com and found out it is vulnerable to Cross Site Scripting once the victim performs the log in.
## Steps To Reproduce:
1. Enter to the following link: ```https://accounts.reddit.com/?dest=blocked:alert(document.domain)```
- If not signed in, the user will be promped to log in and after doing so XSS will excecute
{F2315850}
- If user is logged into his account, following the link will also make the XSS pop up
{F2315847}
## Impact
An attacker could trick users into executing XSS, executing code and stealing their cookies only by them logging in.
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Bounty
$5000.00
Submitted
Weakness
Cross-site Scripting (XSS) - Generic