BugBountyHunter

Dear FirstBlood security team, I found a vulnerability on your service. I hope this report will help you.

Summary

/login.php endpoint has a hidden param called goto, this was vulnerable to Reflective XSS on firstblood v1, and so is Firstblood v2.

Vulnerability Description(PoC)

First of all, if we add goto=hoge on /login.php, then it's reflected in <input name="goto" value="hoge" type="hidden">.

Next, if we input XSS payload, then the server-side sanitizes it.

From my research,

• () parentheses are stripped
• specific words like alert is stripped
• <.*>→if we use less than and greater than, then letters between them are stripped

So I create a PoC to bypass these filters. goto=hoge"/onmouseenter="confirmXSS"/a=

And it works.

Impact

• Firstblood v2 has no HttpOnly attribute in session cookie so the attackers can steal victim's session cookie easily by performing this XSS
• Phishing

Regards, kinako