Summary by HubSpot
It was possible for a user to change their name to include HTML. When that user was deactivated, the deactivation email included the HTML in the user's name fields. The issue is fixed.
- Engagement HubSpot
- Disclosed date over 2 years ago
- Reward $50
- Priority P4 Bugcrowd's VRT priority rating
- Status Resolved This vulnerability has been accepted and fixed
Summary by mega7
Thanks!
Can we disclose?!
Report details
-
Submitted
-
Target Location
events.hubspot.com -
Target category
Other
-
VRT
Server-Side Injection > Content Spoofing > Email HTML Injection -
Priority
P4 -
Bug URL
Empty -
Description
Hello Gents,
- While testing
app-eu1.hubspot.com, I found out that users email could be injected with HTML tag via company name!
Steps to reproduce:
- Please login at https://app-eu1.hubspot.com.
- Navigate to https://app-eu1.hubspot.com/settings/PORTAL-ID/account-defaults/general.
- Inject Account name with HTML payload.
- Now navigate to https://app-eu1.hubspot.com/settings/PORTAL-ID/users.
- Choose your victim and Deactivate.
- Check victim email, HTML will be executed.
Proof of concept:
- POC video in { Attachments }
Thanks and have a nice day!
- While testing
Activity
- Ryan_HubSpot Customer published the disclosure report
- Ryan_HubSpot Customer sent a message
- mega7 requested disclosure
- HubSpot Jira Application OAuth changed the state to Resolved
- mega7 sent a message
- Abdul_hubspot Customer rewarded mega7 $50
- Thanks for your submission! We'll get this over to the appropriate team for further review and remediation. Additionally, we're planning to take a closer look at the HTML injection vulnerabilities that are being triggered via email notifications to portal users so this may affect subsequent HTML injection vulnerabilities you submit that follow this same pattern.
- Abdul_hubspot Customer changed the state to Unresolved
- Abdul_hubspot Customer rewarded mega7 5 points
- mega7 sent a message
- mehmet_bugcrowd changed the state to Triaged
- mehmet_bugcrowd sent a message
- mega7 resolved a blocker for HubSpot by providing information on impact
- mega7 sent a message
- mrhacker_bugcrowd created a blocker on the researcher to provide information on impact
- mrhacker_bugcrowd sent a message
- mega7 created the submission
