Escalating Reflected XSS to High Severity via WAF Bypass + Credential Phishing

Summary

A Reflected XSS vulnerability was identified in a navigation/routing endpoint of a financial institution's web application. The callback GET parameter is reflected unsanitized into a JavaScript context on the client side, allowing arbitrary code execution.

What made this finding particularly interesting is that a WAF was in place, blocking common XSS payloads. The bypass was achieved by combining dynamic code execution (Function()) with location.hash as an out-of-band payload delivery channel, effectively smuggling the malicious code outside the WAF's inspection scope entirely.