🔓 Reflected XSS via File Upload on Sony

Hi,
I discovered a reflected XSS vulnerability via file upload on a Sony subdomain.

Target

Main application: https://*.*.*.sony.com/#/PATH1/PATH2

Vulnerable Link

After uploading a file, the file gets hosted on:

https://*.*.*.sony.com/uploads/PATH1/bnUnlZzw_js_injected_xss.pdf

This link can be shared with any user, and when opened, the injected XSS payload executes.

Impact

• Reflected XSS on a Sony subdomain
• Payload embedded in uploaded PDF filename or response
• Can lead to account takeover via session theft or malicious actions

Reproduction Steps

1. Navigate to: https://*.*.*.sony.com/#/PATH1/PATH2
2. Fill in all required form details
3. Click Continue to proceed
4. Upload the crafted file: js_injected_xss.pdf
5. Get the uploaded link and send it to any victim

📷 Proof of Concept Screenshot:

Payload Location

The file name or part of the PDF was reflected in the response without proper encoding, triggering the script.

Recommendation

Implement proper output encoding of filenames/paths in the response. Avoid reflecting user-generated input into the response without sanitization. Consider CSP and MIME type validation for uploaded files.

🎁 Reward

I was awarded swags for this report.