Summary

A malicious JavaScript payload is executed on Look and Feel formatting fields.

Details

Any user can update their Look and Feel Formatting input fields. The web applications do not sanitize user input. That is why inputting JavaScript causes the reflected xss vulnerability.

PoC

• Login with your username and password
• Goto My account > Look and feel
• In the Formatting sections > List seperator = <img src=0 onerror=alert(1)>
• Click Save
• The JavaScript payload is executed.

Impact

This may lead to

• Session hijacking using phishing attacks
• Exfiltrate sensitive user data