I am creating a bug bounty report for a stored cross-site-scripting exploit that can potentially also cause privilege escalation.

The bug bounty program categorizes Stored XSS as low criticality and Privilege Escalation as medium criticality. So for privilege escalation you will get a higher bounty.

This is how the exploit works:

  1. I (as an employee) can insert malicious JavaScript in a page of the web application.
  2. This JavaScript is stored in the database and will be executed at every user that visits that specific page.
  3. I created a JavaScript payload that gives me the admin role as soon as another admin visits the page (basically I'm just replicating a POST call using the admin's session).

Would this exploit be considered Stored XSS or Privilege Escalation?

  • 1
    The XSS here is the vector for the privilege escalation, I would consider it to be privilege escalation. – iainpb Dec 18 '16 at 21:01
  • @iain But then every stored XSS that I find can be considered privilege escalation right? – Tijme Dec 19 '16 at 11:51
  • 1
    Only when it can be exploited to escalate privilege. I wouldn't expect every stored xss vulnerability to necessarily lead to a privilege escalation. If they did though, i'd be tempted to classify them according to the highest severity. – iainpb Dec 19 '16 at 12:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.