A beginner bug bounty hunter discovered a Self-XSS vulnerability in Amazon's developer.amazon.com where Security Profile names were reflected in source code, which they escalated to a logout CSRF issue. The vulnerability was reported, triaged, and fixed within a week, though no monetary reward was offered per Amazon's policy.
A reflected XSS vulnerability on Amazon's masclient endpoint (/gp/masclient/dp/) allows attackers to inject arbitrary HTML/JavaScript by exploiting insufficient input validation and capitalization of product IDs. The author demonstrates cookie theft and session hijacking via SVG onload attributes with HTML entity encoding to bypass browser XSS protections.
Researcher discovered a reflected XSS vulnerability on Amazon's ad system domain (ws-na.amazon-adsystem.com) via the tracking_id parameter, then bypassed Amazon's initial fix using an alternative payload technique.