worm

2 articles
sort: new top best
clear filter
0 8/10

A creative XSS exploitation technique that transforms a reflected/stored XSS vulnerability in Swisscom's Bluewin webmail into a self-propagating worm via malicious attachment filenames. The worm leverages unescaped angle brackets in attachment metadata to inject JavaScript that can automatically enumerate and send itself to other users' contacts.

Swisscom Bluewin webmail.bluewin.ch rich-v01.bluewin.ch Nicolas Heiniger Alexandre Florian BlackAlps
blog.compass-security.com · devanshbatham/Awesome-Bugbounty-Writeups · 20 hours ago · details
0 8/10

A persistent XSS vulnerability on eBay's My World profile section exploited a blacklist-based HTML filter that failed to block deprecated tags like <plaintext>, <fn>, and <credit>. The attacker chained this with event handlers, String.fromCharCode/eval to bypass character limits, missing CSRF protection, and unHTTPOnly cookies to create a self-propagating worm that could steal session tokens.

eBay myworld.ebay.com plaintext fn credit
whitton.io · devanshbatham/Awesome-Bugbounty-Writeups · 20 hours ago · details