Stored XSS on Zendesk via Macro’s PART 2

Hariharan.s
Sep 20 · 2 min read

Hi Guys,

This is the continuation of my first write of Stored XSS Via Alternate Text At Zendesk Support.

So let's get back to business..As i was investing the XSS issue on the platform i noticed that the XSS Popup was triggered TWO times on the homepage. So i searched for the endpoint where the XSS payload got executed.

But no luck, So i removed my payload from the first vulnerable endpoint that is the Alternate Url Text and checked the homepage. To my suprise the XSS pop triggered as usual but this time it pop’d up only ONCE.

So i look up the macro if i had entered the payload anywhere else and of course i had entered a payload on the macro description field. So i found an another vulnerable endpoint. Time for POC.

For POC purposes i created a fresh macro and entered the payload on the macro description field and click on save…A Web Application Firewall(WAF) came smiling upon me Saying “YOU HAVE BEEN BLOCKED”.

WAF BYPASS TIME!!!!!!!!!!!!!!!

After learning about the working of the WAF i found out a “Not so Complicated” Method to bypass It.

Don't Enter the payload in beginning itself while creating the macro. Instead while creating the macro just enter random things in the description and after creating the macro edit the description and enter the payload.

Shorter version : WAF only scans the content that is entered the first time and does not care what you enter afterwards.

After this BYE BYE WAF. The payload got saved successfully and also got triggered on the homepage.

Report Timeline :

  • Aug 10th- Report Submitted
  • Aug 11th- Closed as duplicate of my first report
  • Aug 17th- Report reopened after providing info that the two xss issues are different
  • Aug 23rd- Bounty Time $$$
  • Aug 26th- Resolved and Got listed on their HOF

Few Things to Say..

  1. Check the number of XSS triggers ( Number of XSS triggers = Number of Vulnerable endpoints)
  2. Try to Bypass the WAF by not only changing the payload.

3. The payload that i used is <img src=x onerror=alert(document.cookie)>

MAY THE BUGS BE WITH YOU,

P5YCH0(@DJHARIZ1)

Welcome to a place where words matter. On Medium, smart voices and original ideas take center stage - with no ads in sight. Watch
Follow all the topics you care about, and we’ll deliver the best stories for you to your homepage and inbox. Explore
Get unlimited access to the best stories on Medium — and support writers while you’re at it. Just $5/month. Upgrade