Converting Self XSS to Non-Self XSS for a $$$ Bounty

Overview:

This report details how I upgraded the severity of a self XSS vulnerability to a non-self XSS via CSRF, changing its status from P5 to P3.

Initial Discovery:

1. Self XSS Identification: Initially, I discovered an XSS vulnerability in a form submitted using the POST method. This meant the exploit was self-contained, classifying it as self XSS since I couldn't send the link to victims.
2. Assessing the Potential for Non-Self XSS: I questioned whether this self XSS could be converted to a non-self XSS via CSRF.

---

Analysis and Exploitation:

Request Interception: I intercepted the form submission request and noticed the absence of a CSRF token, indicating a CSRF vulnerability. Payload Injection: I injected the following payload into the search box and intercepted the request:"><img src=x onerror=alert()> CSRF PoC Creation: Using Burp Suite, I created a CSRF proof of concept (PoC) and tested it in the browser. The XSS was successfully triggered via CSRF, converting the vulnerability to non-self XSS.

Reporting and Validation:

1. Initial Submission: The vulnerability was initially marked as informational.
2. New Submission: I made a new submission including the CSRF PoC to demonstrate the non-self XSS.
3. Validation: I tested the PoC on multiple devices to confirm the absence of a CSRF token and ensure consistent exploitation.

---

Outcome:

1.Report Status Changes: 1. After 3 days, the report status changed to triaged. 2.After 5 days, the submission status was changed to unresolved.

2.Bounty Awarded: I received the bounty following the report's validation.

Response from Bugcrowd Team:

Tips for Converting Self XSS to Non-Self XSS:

1. Always check for CSRF vulnerabilities when dealing with form submissions.
2. Use tools like Burp Suite to intercept and analyze requests.
3. Test PoCs across multiple devices to confirm the absence of CSRF protection.

I hope this information is helpful to you.

Best regards, Secone4all_admin