Cross-Site Scripting (XSS) in ASP.NET via ResolveUrl on ███████
该报告还没有中文解读。
原文摘录
摘自原文（1367 字符中的一小部分）
Description: Hi, team! A Cross-Site Scripting (XSS) vulnerability was identified in an ASP.NET web application on the ██████████ . The issue arises from improper handling of URLs passed to the ResolveUrl method, which fails to sanitize user-controlled input. This allows injection of arbitrary …
原文中的代码
Payload used: (Z('ontestingb3t2h onload=print`` fnwve='zzzzz`8504695818`'))
- This payload successfully triggered JavaScript execution using the onload attribute.
- The use of print`` instead of alert()` was necessary to bypass Web Application Firewall (WAF) protections and filter-based …默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 U.S. Dept Of Defense 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @jonasdiasrebelo · 版权归作者与 U.S. Dept Of Defense 所有