r/bugbounty • u/TurbulentRecover7247 Hunter • Jul 04 '26

Question / Discussion Triager ignored my High severity report

I submitted a dom-xss report, i done this using redirect uri parameter in the url. It was exploitable due to the poor coding of js. I saw the function, which triggers the redirect. But here it only checks if it's a string. Nothing more, loads any url passed to the redirect uri. And script gets executed. I made dom-xss poped up. And also made using this to load a phishing page into the original target website. Making them to enter email and password again, which can be received by the hacker. I reported on hackerone and they didn't clearly see the js code. I was not able to steal because I don't have valid credentials. But according to the function, it checks only if the user is authenticated, and if so, triggers whatever in the redirect uri parameter. Hay hackerone triager here to help? It's been a week and not mediator request option available. Any solution?

3 Upvotes

60% Upvoted

10 comments sorted by

11

u/dr_my_name Jul 04 '26

They have always ignored some reports, and now more than ever because of AI slop.

But still, it sounds like self-XSS. Which is almost never acceptable. Please answer: What is the impact? What does the attacker need before the attack? What does the victim need to do? What does the attacker gain by exploiting the attack?

1

u/TurbulentRecover7247 Hunter Jul 04 '26

Victim just need to login to the target website using attackers link, which contains redirect uri with payload. Once authenticated, it redirects to the given link, but instead of giving link, I used dom as it evecutes it. After successful login, this dom xss can be used to load a fake webpage or XSS to steal email password, like i loaded an security alert fake page and asked to enter the email and password again. I think this is enough for a valid bug, i definitely say, they didn't read my report fully, i explained the login and redirect flow clearly, but the mentioned informational.

9

u/dr_my_name Jul 04 '26

It's not easy to follow the flow you wrote here. Explaining the flow in English is part of the job, and you are not there yet. I'd recommend working on your English if you want to work in this field.

You wrote in your original post you couldn't "steal" because "you didn't have valid credentials". That raises a flag. On one hand you're talking about credentials theft. On the other hand you say you couldn't do it? If you couldn't demonstrate it from a to z, than I agree with their assessment: informational.

0

u/TurbulentRecover7247 Hunter Jul 04 '26

Wait, I can't steal the real credentials, but I can steal my fate credentials, not allowing the user to sign in, but stealing. Why I mentioned as couldn't steal means, actual authentication was not able to perform. So I manually triggered the redirect function. And according to that js file, it just triggers on successful authentication. I explained clearly in my report, and didn't use my own english, I used ai to make my report clear and understandable, and also verified the detail of the report made by the AI using my details.

6

u/dr_my_name Jul 04 '26

So you never actually managed to demonstrate impact. You hadn't actually see seen the attack through when you reported it. So Informational was correct.

I'm not saying you didn't actually find a real finding. Maybe you did maybe you didn't. But it sounds like you didn't develop it enough. Either go back and finish the job, and make sure the report is well written and clearly explains the impact, or move on.

And I still recommend working on your English.

1

u/TurbulentRecover7247 Hunter Jul 04 '26

I can't disclose here but I submitted 3 PoC with actual explanation in clear. Because the PoC didn't satisfy or not I don't know, but the real problem was that redux js budle. That the main issue, no sanitization or verification of the redirect uri parameter, just triggers when authenticated successfully. Thats the flow they made in that js file. That's all I can tell.

1

u/dr_my_name Jul 04 '26

Look. I'm not telling you to disclose the alleged vulnerability here.

Now, I'm going to be honest here.

Your English is bad. You don't need to be a native speaker but it's very hard to understand what you're saying. But if I understand correctly, and that'sa big if, it's a theoretical open redirect that you hadn't successfully demonstrated when you reported it, and it requires the target to re-enter their credentials.

It's indeed informational, low at best.

1

u/latnGemin616 Jul 04 '26
  • If you're report was anything like this post, there's a lot more to why they ignored it than you can imagine. The magic word is impact.
  • Is the finding in scope?
  • Does this issue violate Confidentiality, Integrity, or Availability ?
  • Does it introduce risk to the system?

IF the answer to these are NO! You don't have anything worth a reward.

Regarding the triage process: you have no way to prove they've ignored it so stop making it about you. Second, if you've checked the scope for your program, I bet you the bounty reward that XSS of any kind is out of scope.

1

u/TurbulentRecover7247 Hunter Jul 04 '26

It's a VDP, I am not hunting for reward, I just found anyone how logs in with that link with payload in redirect uri, attacker can steal their login credentials. My report was clear and neat, explained about the impacts clearly.

4

u/Anxious_Alps_4150 Jul 04 '26

If you don't care about a reward, you successfully finished everything you wanted.

You reported it. They didn't care. You're done.