This morning, I received a notification from OpenBugBounty.org that an XSS vulnerability had been found on ChrisHammond.com. The email included a link to a bug bounty report but lacked specific details about the issue.
I quickly set up an account on OpenBugBounty.org and attempted to claim the domain to gain more information. Upon successfully doing so, I was provided with the display name of the researcher who reported the issue. I reached out to them via email, albeit cautiously, as I was unsure if it might be a phishing attempt.
To my relief, the researcher responded within a few hours with additional details about their findings. The vulnerability was traced back to a recent update I made to the Engage Publish module. For several years, I had disabled tags across the site due to performance issues. Recently, in an effort to improve SEO, I re-enabled tags and set the incoming tags to display on the tag listing page. Unfortunately, I didn't properly scrub the input before displaying it, allowing XSS to be injected directly into the page.
The researcher's email included the following:
I AM Mr. PINKY PRAJAPATI, a white-hat security researcher student who found a Cross-site Scripting (XSS) vulnerability.
The email also provided reproduction steps and a screenshot of the issue.
I immediately dove into the Engage Publish source code to address the problem and deployed the fix to the website.
I want to extend my heartfelt thanks to Mr. Pinky Prajapati for identifying and reporting the XSS vulnerability. Your diligence and expertise in uncovering this issue are greatly appreciated. The detailed information you provided, including the reproduction steps and screenshot, were invaluable in helping me understand and quickly address the problem. Thanks to your efforts, I was able to promptly fix the vulnerability and secure the website.
Your contribution not only helped improve the security of ChrisHammond.com but also underscored the importance of community-driven efforts in maintaining a safe online environment. I am truly grateful for your assistance and dedication as a white-hat security researcher.
Thank you once again for your support and for helping to keep the web a safer place.
Best regards,
Chris Hammond