Would XSS that can cause privilege escalation be considered XSS or privilege escalation?

Question

I am creating a bug bounty report for a stored cross-site-scripting exploit that can potentially also cause privilege escalation.

The bug bounty program categorizes Stored XSS as low criticality and Privilege Escalation as medium criticality. So for privilege escalation you will get a higher bounty.

This is how the exploit works:

1. I (as an employee) can insert malicious JavaScript in a page of the web application.
2. This JavaScript is stored in the database and will be executed at every user that visits that specific page.
3. I created a JavaScript payload that gives me the admin role as soon as another admin visits the page (basically I'm just replicating a POST call using the admin's session).

Would this exploit be considered Stored XSS or Privilege Escalation?

Answer 1

I think it is both. In the first place, you have found a Stored XSS vulnerability that allows for the injection of arbitrary scripts. These scripts can be used for various malpractices, like page defacing, open redirect, etc.

You then found that the Stored XSS could be abused to gain privilege escalation, which could be seen as a request forgery. The app should have defensive measures against this in place, so that these requests could not be forged, even not when JavaScript code could be injected.

Therefore I would argue it are two different vulnerabilities that would definitely count towards the 'higher' privilege escalation bounty, or even to two bounties since the vulnerabilities are technically distinct. (You might have been able to execute the privilege escalation also in the context of Cross Site Request Forgery (CSRF), if the circumstances were right).