1761650 - XSS via https://support.mozilla.org/en-US/users/edit

Status: RESOLVED FIXED

(support.mozilla.org :: General, defect)

Description

[Kei]

I would like to report an XSS which occurs in the parameter &country= when saving your profile to be updated.

Steps to reproduce the issue:

1. Login your profile https://support.mozilla.org/en-US/users/edit

2. Save your request/profile and you will see the parameters, namelessly the &country= one is what we're looking at.

See screenshot: https://prnt.sc/hKq17BUoh_kh

3. Inside of the &country= add the following payload &country=\"><svg/onmouseover=alert(document.domain)> and after saving and turning off your browser's proxy, you shall be prompted with an XSS alert.

Here's a video POC attached below.

I understand this is a self XSS, however this is also an unintended behavior.

A small monetary reward may or may not be awarded.

Comment 1

[Kei]

Since the video POC did not upload. I decided to upload it onto my private account.

• https://streamable.com/thv3bk

Comment 2

[Frida K [:frida]]

Hello Kei,

Thank you for your report.

I can confirm the XSS. As you can see in the screenshot, the country parameter is reflected back in the response without encoding which allows the XSS to execute.

I will follow up with the team so that they can look into it.

Thanks,
Frida

Comment 3

[Frida K [:frida]]

Attachment: XSS payload reflected in response

Comment 4

[Frida K [:frida]]

Attachment: XSS payload is executed

Comment 5

[Frida K [:frida]]

Hello Leo, Hello Tasos,

Can you please take a look at this report?

Thanks,
Frida

Comment 6

[Kei]

Hello,

Any updates on the bug bounty payment?

Comment 7

[Frida K [:frida]]

Hello Kei,

We usually discuss payments when the issue is fixed.

Thanks,
Frida

Comment 8

[Kei]

(In reply to Frida Kiriakos [:frida] from comment #7)

Hello Kei,

We usually discuss payments when the issue is fixed.

Thanks,
Frida

Got it.

Thank you.

Comment 9

[Kei]

Hello, any updates in regards to this?

Comment 10

[Frida K [:frida]]

Hello Kei,

The bug is assigned to the engineering team so they are aware of the bug and are working on it. We will post updates to the bug when we have more information.

Thanks,
Frida

Comment 11

[Tasos Katsoulas [:tasos]]

PR https://github.com/mozilla/kitsune/pull/5092

Comment 12

[Kei]

(In reply to Tasos Katsoulas [:tasos] from comment #11)

PR https://github.com/mozilla/kitsune/pull/5092

Awesome.

This is great news.

How do I go about getting a bounty?

Comment 13

[Frida K [:frida]]

Hello Kei,

When the fix is deployed and the bug is resolved as FIXED, we have a bug bounty panel that meets every week (unless there is a holiday) to decide on bug bounties. So we will update this bug when we a decision about the bounty.

Thanks,
Frida

Comment 14

[Kei]

Hello,

It's been a week now. Any updates on the payment?

Comment 15

[Frida K [:frida]]

Please refer to comment 13. We are waiting for the bug to be fixed in order to discuss the bounty.

Comment 16

[Frida K [:frida]]

The issue is fixed on staging, I will leave the bug open until changes are deployed to production.

Comment 17

[Tasos Katsoulas [:tasos]]

The fix has been released to prod.

Comment 18

[Kei]

Hello,

Updates on this again.

Comment 19

[Frida K [:frida]]

I can confirm the fix on production.

Thanks very much for reporting this issue to us. Now that the issue is fixed, the bug bounty team will be reviewing your report over the upcoming weeks to decide on the award (if any) Mozilla will be granting for this report. It may take up to 3 weeks but know that we've not forgotten this ticket, we have a tracking system and a review cadence that will ensure that all potentially bounty eligible reports get reviewed and acted on.

Comment 20

[Daniel Veditz [:dveditz]]

Unfortunately self-XSS are excluded from our bounty program.