Account takeover through the combination of cookie manipulation and XSS
该报告还没有中文解读。
原文摘录
摘自原文（6483 字符中的一小部分）
**Summary:** A cookie based XSS on www.grammarly.com exists due to reflection of a cookie called gnar_containerId in DOM without any sanitization. Normally, gnar_containerId is being set by the server however a vulnerable endpoint at gnar.grammarly.com called "/cookies" allows us to manipulate …
原文中的代码
<html>
<head>
<title>Grammarly POC</title>
<meta charset="utf-8"/>
<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js"></script>
</head>
<body>
<script>
var cookie_hax = { …默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Superhuman (formerly Grammarly) 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @k4r4koyun · 版权归作者与 Superhuman (formerly Grammarly) 所有