Case Study: Automotive Marketplace Platform

Independent Application Security Assessment

Engagement Type: Authorized Bug Bounty (Managed Program)
Assessment Period: January 2026
Vulnerability Class: Cross-Site Scripting (Stored)

---

Executive Summary

This case study documents a security assessment conducted against an automotive marketplace platform as part of an authorized bug bounty program. The assessment identified a stored Cross-Site Scripting (XSS) vulnerability in the vehicle inquiry submission form, confirmed through blind XSS callback methodology. The vulnerability allowed attacker-controlled JavaScript to execute in the browser context of internal dealer/staff systems when processing customer inquiries.

---

Scope and Authorization

In Scope: Public-facing web application features and API endpoints
Out of Scope: Automated scanning, denial of service, social engineering, physical security, descriptive error messages

Authorization: All testing conducted under authorized bug bounty program. Only researcher-owned test accounts used. No real user data accessed or modified.

---

Methodology

Testing followed a manual, hypothesis-driven approach:

Phase 1: Reconnaissance — Manual browsing, technology identification, attack surface mapping
Phase 2: Authentication Testing — Cookie analysis, session lifecycle mapping
Phase 3: Input Validation Testing — Form submission analysis, injection point discovery
Phase 4: Blind XSS Deployment — Webhook infrastructure, payload submission, callback monitoring

---

Technology Stack Identified

CDN / WAF: Cloudflare.

Backend: Java with Hibernate ORM.

Cache: Redis.

Infrastructure: Kubernetes.

Frontend: React.

Session Management: Cookie-based.

---

Validated Vulnerabilities

Finding #1: Stored XSS via Vehicle Inquiry Form

Severity: High
Category: Cross-Site Scripting (Stored)
CWE: CWE-79 — Improper Neutralization of Input During Web Page Generation
Status: Confirmed via blind callback

Technical Detail

The vehicle inquiry submission endpoint failed to sanitize user-supplied input before storing it in the database. When dealer/staff personnel subsequently viewed submitted inquiries through their internal CRM or dashboard, stored JavaScript payloads executed in their browser context.

The vulnerable parameter in the inquiry submission request allowed attacker-controlled input. A payload was submitted through a legitimate inquiry form and triggered four separate HTTP callbacks to a researcher-controlled webhook endpoint, confirming JavaScript execution.

Business Impact

Stored XSS in dealer-facing systems allows:

• Session hijacking of dealer accounts
• Access to customer PII visible in dealer CRM
• Manipulation of lead/inquiry data
• Phishing attacks against dealers
• Lateral movement to dealer network

Evidence

Multiple callbacks from dealer IP addresses confirmed:

• Payload survived storage in database
• Payload executed in dealer browser context
• JavaScript not sanitized on output
• Affected internal CRM/lead management system

---

Security Controls Assessment

Infrastructure

✅ Cloudflare WAF blocked direct reflection attacks
❌ Stored/blind XSS bypassed WAF entirely
✅ Kubernetes test environment properly secured (access denied)
✅ Redis cache properly configured (user identity in cache keys)

Application

❌ Public user input reached internal dealer systems without sanitization
❌ Dealer CRM lacked output encoding for user-supplied data
✅ Backend likely uses parameterized queries (no SQL injection observed)
✅ Form validation present but insufficient

Security Headers

❌ Missing X-XSS-Protection header
❌ Missing X-Content-Type-Options header
❌ Missing X-Frame-Options header

---

Dead Ends Investigated

Automated Scanning: Blocked by Cloudflare WAF.

Direct XSS Reflection: Blocked by the WAF.

SQL Injection: No errors observed; likely protected through parameterized queries.

Subdomain Brute Force: Rate limited, resulting in low return on effort.

Port Scanning: Blocked by Cloudflare.

Email Header Injection: Server-side protections prevented exploitation.

---

Key Lessons Learned

1. WAF is Not Sufficient

Cloudflare blocked direct XSS but blind XSS via stored payloads bypassed it entirely. Security controls at the perimeter do not guarantee internal security.

2. Internal Tools Need Security Too

The dealer CRM was the execution context, not the public site. Internal systems are often less protected than external-facing applications.

3. Input from Public Users Reaches Internal Systems

The security boundary between public form and internal CRM was not maintained. Organizations must treat internal systems as receiving untrusted input.

4. Output Encoding Matters More Than Input Validation

Even if you miss some inputs, proper encoding on output prevents execution. This is a defense-in-depth control that should never be skipped.

5. Blind XSS Requires Patience

48-72 hour wait for dealer to view inquiry. Webhook callbacks are solid evidence of execution.

---

Recommendations

Immediate

1. Implement context-aware output encoding in dealer CRM for all user-supplied data (OWASP Java Encoder)
2. Sanitize free-text fields before storage using allowlist approach (OWASP AntiSamy)

Short-Term

1. Implement strict Content Security Policy on dealer CRM
2. Enforce strict input validation on all form fields server-side
3. Add missing security headers (X-XSS-Protection, X-Content-Type-Options, X-Frame-Options)

Strategic

1. Regular penetration testing of dealer CRM
2. Automated DAST scanning in CI/CD pipeline
3. Developer security training on secure coding practices

---

Conclusion

The assessment identified one confirmed stored XSS vulnerability through systematic manual testing and blind XSS methodology. The vulnerability affects internal dealer systems that process public-facing customer inquiries, representing a meaningful security boundary failure.

The assessment demonstrated that modern WAF protection can be bypassed through stored/blind XSS techniques that avoid direct reflection. The 48-72 hour execution timeline reflects real-world dealer operations and confirms the vulnerability exists in a production system actively used by dealers.

---

Assessment conducted under authorized bug bounty program. All testing performed ethically using researcher-owned test accounts. No real user data was accessed, modified, or exfiltrated.