Stored XSS Chain Earns $15,000 Bug Bounty

Summary

A bug-bounty researcher describes bypassing a WAF to exploit stored XSS in an events app, then using an invitation flow and a CSP bypass to demonstrate account-takeover risk.

Key points

• The presenter says the finding earned a $15,000 bounty during a HackerOne live-hacking event.
• A request with the Content-Encoding gzip header bypassed WAF rules that had blocked the tested input.
• The stored XSS first affected the researcher’s own profile in the events application.
• Inviting an existing events user could cause the XSS to run when that user opened the page, creating a reported account-takeover path.
• A CSP bypass involved a customer-domain subdomain takeover and a hosted JavaScript file; the presenter says this part was not included in the recreated lab.
• The demonstration highlights risks when applications share sessions and profile data but handle input and security controls differently.