1

I am creating a bug bounty report for a stored cross-site-scripting exploit that can potentially also cause privilege escalation.

The bug bounty program categorizes Stored XSS as low criticality and Privilege Escalation as medium criticality. So for privilege escalation you will get a higher bounty.

This is how the exploit works:

  1. I (as an employee) can insert malicious JavaScript in a page of the web application.
  2. This JavaScript is stored in the database and will be executed at every user that visits that specific page.
  3. I created a JavaScript payload that gives me the admin role as soon as another admin visits the page (basically I'm just replicating a POST call using the admin's session).

Would this exploit be considered Stored XSS or Privilege Escalation?

3
  • 1
    The XSS here is the vector for the privilege escalation, I would consider it to be privilege escalation.
    – iainpb
    Dec 18, 2016 at 21:01
  • @iain But then every stored XSS that I find can be considered privilege escalation right?
    – Tijme
    Dec 19, 2016 at 11:51
  • 1
    Only when it can be exploited to escalate privilege. I wouldn't expect every stored xss vulnerability to necessarily lead to a privilege escalation. If they did though, i'd be tempted to classify them according to the highest severity.
    – iainpb
    Dec 19, 2016 at 12:12

1 Answer 1

1

I think it is both. In the first place, you have found a Stored XSS vulnerability that allows for the injection of arbitrary scripts. These scripts can be used for various malpractices, like page defacing, open redirect, etc.

You then found that the Stored XSS could be abused to gain privilege escalation, which could be seen as a request forgery. The app should have defensive measures against this in place, so that these requests could not be forged, even not when JavaScript code could be injected.

Therefore I would argue it are two different vulnerabilities that would definitely count towards the 'higher' privilege escalation bounty, or even to two bounties since the vulnerabilities are technically distinct. (You might have been able to execute the privilege escalation also in the context of Cross Site Request Forgery (CSRF), if the circumstances were right).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .