Writeups

Showmax - Unvalidated Redirect and XSS

Showmax disclosed on HackerOne: Open Redirect in secure.showmax.comHackerOne

Researcher discovered an unvalidated redirect on a Showmax in a payment method flow. Researcher received an email advertising Showmax 14 day free trial. Clicking the link directed the researcher to a payment page. In on of the HTTP request bodies the following URL was found. The URL parameter redirection_url was found to not only be vulnerable to unvalidated redirects, but also to XSS.

https://secure.showmax.com/v97.3/website/payment/subscriptions/zooz_card/three_d_secure?redirection_url=https://payu.co.za.....

Changing the redirection_url to google will redirect the user to google. Changing the parameter to contain the XSS payload javascript:%250Aalert(1) will trigger reflected XSS.

https://secure.showmax.com/v97.3/website/payment/subscriptions/zooz_card/three_d_secure?redirection_url=https://google.com to https://secure.showmax.com/v97.3/website/payment/subscriptions/zooz_card/three_d_secure?redirection_url=javascript:%250Aalert(1)

Reflected XSS

Researcher thankfully provided a detailed blog post here:

BUG BOUNTY: How I earned $550 in less than 5 minutes. “Open Redirect chained with rXSS”Medium

Upserve URL Pathway

Upserve disclosed on HackerOne: Open redirect at...HackerOne

Researcher discovered unvalidated redirect on URL https://inventory.upserve.com/ in the applications root URL path. Appending any URL to the URL will redirect the user there. Thus the following URL redirects to google:

https://inventory.upserve.com/http://google.com/

Hanno

Hanno's projects disclosed on HackerOne: Open redirect on...HackerOne

Researcher discovered Open Redirect on endpoint https://blog.fuzzing-project.org/exit.php?url= <url>. The HTTP URL parameter url is vulnerable, supplying any attacker controlled site to the parameter will redirect the user there.

Entering the following URL into a web browser would redirect the user to google.com:

https://blog.fuzzing-project.org/exit.php?url=google.com

Others

GitHub Gist - Account takeover via open redirect - $10,000 Bountydevcraft.io

http://ngailong.com/uber-login-csrf-open-redirect-account-takeover/ngailong.com

https://xpoc.pro/oauth-authentication-bypass-on-airbnb-acquisition-using-weird-1-char-open-redirect/

Airbnb - Chaining Third-Party Open Redirect into Server-Side Request Forgery (SSRF) via LivePerson ChatBrett Buerhaus

Godaddy XSS affects parked domains redirector/processor!Seekurity

https://www.mohamedharon.com/2019/02/still-work-redirect-yahoo-subdomain-xss.htmlwww.mohamedharon.com