Cross-site Scripting (XSS) - DOM (CWE-79)CVSS 8.1€470
DOM XSS to High Severity via Credential Phishing Overlay
A DOM-based XSS vulnerability was discovered affecting multiple endpoints within a financial institution's web application. The target_route parameter was being processed client-side without proper validation or sanitization. This flaw allowed an attacker to execute arbitrary JavaScript code by utilizing the javascript: URI scheme.
Summary
A DOM-based XSS vulnerability was discovered affecting multiple endpoints within a financial institution's web application. The target_route parameter was being processed client-side without proper validation or sanitization. This flaw allowed an attacker to execute arbitrary JavaScript code by utilizing the javascript: URI scheme.
Affected Endpoints
The vulnerability was present on several application pages. Some examples include:
https://www.redacted-bank.com/retail/promotions-search?target_route=javascript:...