Headline
CVE-2022-43363: WAF bypass XSS Vulnerability in TelegramReflected cross-site scripting (or X - Pastebin.com
** DISPUTED ** Telegram Web 15.3.1 allows XSS via a certain payload derived from a Target Corporation website. NOTE: some third parties have been unable to discern any relationship between the Pastebin information and a possible XSS finding.
Untitled
Nov 22nd, 2022
66
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
- WAF bypass XSS Vulnerability in Telegram
- Reflected cross-site scripting (or XSS) arises when an application receives data in an HTTP request and includes that data within the immediate response in an unsafe way.
- Payload: echo https://target.com | waybackurls | grep “=” | egrep -iv".(jpg|jpeg|gif|css|tif|woff|woff2|icon|pdf|svg|txt|js)" | uro | qsreplace">’|freq Target: Expect More. Pay Less.
Mitigation
Update to latest version of Telegram