HTML Injection / Reflected Cross-Site Scripting with CSP on https://accounts.firefox.com/settings
跨站脚本 / Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) / #1880896
该报告还没有中文解读。
原文摘录
摘自原文（2827 字符中的一小部分）
There is a vulnerability on accounts.firefox.com, where the flowId parameter is reflected into the server response without being escaped for HTML. This causes a Cross-Site Scripting attack, which may allow attackers to take over accounts. To do that, one would need to bypass the …
原文中的代码
Content-Security-Policy: connect-src 'self' https://api.accounts.firefox.com https://graphql.accounts.firefox.com https://oauth.accounts.firefox.com https://profile.accounts.firefox.com wss://channelserver.services.mozilla.com https://channelserver.services.mozilla.com https://*.sentry.io …
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Mozilla 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @clsn · 版权归作者与 Mozilla 所有