3 ms·

This is a fair point. I actually hesitated a bit before posting my comment because I don't actually know 100% that the XSS was harmless. But the reporter didn't

This is a fair point. I actually hesitated a bit before posting my comment because I don't actually know 100% that the XSS was harmless. But the reporter didn't actually demonstrate anything other than an alert('owned').

hhh 3y ago
I don't understand, is arbitrary js execution not enough?
- viraptor 3y ago
  It depends. Where is that JS executed? On the login page? The payment details form? In a restricted IFrame serving a tracking pixel? On a static page handling public document downloads with a different domain to the logged in contexts? With a good security report, you want to include example impact. "I can run alert." - meh, but should be checked/patched just in case. "I can run arbitrary JS on a page collecting payment details, without CSP restriction." - now that's immediately bad.
- michaelt 3y ago
  You may have noticed many websites host user-uploaded content on a different domain to their main site. Github delivers some things from githubusercontent.com, Google some things from googleusercontent.com, Reddit delivers some things from redditmedia.com and so on. The reason they do this is to give a big layer of protection against the harms of XSS - even if user-uploaded content manages to execute arbitrary javascript on googleusercontent.com the that javascript can't access cookies for google.com as it's hosted on a different domain. Some scoring guides rate XSS as very high risk, assuming you don't have this mitigation in place. resonious had the mitigation already ("it was under an odd domain that doesn't host any authenticated resources") so the XSS wasn't a very high risk. With that said - some people will thank you for demonstrating how a small security problem can be escalated into an account takeover, but other people will call the cops on you for hacking their website or threaten to sue you. So I would say if you're reporting XSS it's reasonable to stick with an alert box, unless you know the person receiving the reports is reasonable.
  - Thorrez 3y ago
    >Google some things from googleusercontent.com, Reddit delivers some things from redditmedia.com and so on. Exactly: >If you are injecting script in subdomains of (sandbox) domains such as: [...] ...we won't file a bug based on your report, unless you can come up with an attack scenario where the injected code gains access to sensitive user data. https://bughunters.google.com/learn/invalid-reports/web-platform/xss/6619189462433792/xss-in-sandbox-domains https://bughunters.google.com/learn/invalid-reports/web-plat... e.g. https://www-tutorialrepublic-com.translate.goog/codelab.php?topic=javascript&file=alert-popup-box&_x_tr_sl=en&_x_tr_tl=es&_x_tr_hl=en&_x_tr_pto=wapp https://www-tutorialrepublic-com.translate.goog/codelab.php?...
- Scea91 3y ago
  It can definitely impact the company’s reputation negatively. If any of our sites allowed alert(“owned”) it would be top priority to fix.
- resonious 3y ago
  It's not. If it is, then why not go file a report at jsfiddle.net?

hhh 3y ago

I don't understand, is arbitrary js execution not enough?

viraptor 3y ago
It depends. Where is that JS executed? On the login page? The payment details form? In a restricted IFrame serving a tracking pixel? On a static page handling public document downloads with a different domain to the logged in contexts? With a good security report, you want to include example impact. "I can run alert." - meh, but should be checked/patched just in case. "I can run arbitrary JS on a page collecting payment details, without CSP restriction." - now that's immediately bad.
michaelt 3y ago
You may have noticed many websites host user-uploaded content on a different domain to their main site. Github delivers some things from githubusercontent.com, Google some things from googleusercontent.com, Reddit delivers some things from redditmedia.com and so on. The reason they do this is to give a big layer of protection against the harms of XSS - even if user-uploaded content manages to execute arbitrary javascript on googleusercontent.com the that javascript can't access cookies for google.com as it's hosted on a different domain. Some scoring guides rate XSS as very high risk, assuming you don't have this mitigation in place. resonious had the mitigation already ("it was under an odd domain that doesn't host any authenticated resources") so the XSS wasn't a very high risk. With that said - some people will thank you for demonstrating how a small security problem can be escalated into an account takeover, but other people will call the cops on you for hacking their website or threaten to sue you. So I would say if you're reporting XSS it's reasonable to stick with an alert box, unless you know the person receiving the reports is reasonable.
- Thorrez 3y ago
  >Google some things from googleusercontent.com, Reddit delivers some things from redditmedia.com and so on. Exactly: >If you are injecting script in subdomains of (sandbox) domains such as: [...] ...we won't file a bug based on your report, unless you can come up with an attack scenario where the injected code gains access to sensitive user data. https://bughunters.google.com/learn/invalid-reports/web-platform/xss/6619189462433792/xss-in-sandbox-domains https://bughunters.google.com/learn/invalid-reports/web-plat... e.g. https://www-tutorialrepublic-com.translate.goog/codelab.php?topic=javascript&file=alert-popup-box&_x_tr_sl=en&_x_tr_tl=es&_x_tr_hl=en&_x_tr_pto=wapp https://www-tutorialrepublic-com.translate.goog/codelab.php?...
Scea91 3y ago
It can definitely impact the company’s reputation negatively. If any of our sites allowed alert(“owned”) it would be top priority to fix.
resonious 3y ago
It's not. If it is, then why not go file a report at jsfiddle.net?