Misskey < 10.102.4 - Token Hijacking via Cross-Site Scripting
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2019-1020010. PoCs published by DXY0411.
AI-analyzed exploit summary This repository contains a functional exploit PoC for CVE-2019-1020010, demonstrating an XSS vulnerability in Misskey. The exploit involves creating a malicious app with an XSS payload, generating a session link, and posting it to lure victims into clicking it, which then exfiltrates sensitive data (e.g., localStorage items) to an attacker-controlled server.
Description
Misskey before 10.102.4 allows hijacking a user's token.
Exploits (1)
This repository contains a functional exploit PoC for CVE-2019-1020010, demonstrating an XSS vulnerability in Misskey. The exploit involves creating a malicious app with an XSS payload, generating a session link, and posting it to lure victims into clicking it, which then exfiltrates sensitive data (e.g., localStorage items) to an attacker-controlled server.
References (1)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N