writeups.xyz / Stealing passwords from infosec Mastodon - without bypassing CSP

Submitter : c2a

Date: 15 November 2022

Bounty : undisclosed

Vulnerabilities :

• HTML Injection

Programs :

• Mastodon
• Infosec.exchange

Authors :

• Gareth Heyes (@Garethheyes)

Link :
https://portswigger.net/research/stealing-passwords-from-infosec-mastodon-without-bypassing-csp