Basecamp: Cross-account stored XSS on app.basecamp.com leads to persistent administrator takeover

A cross-account stored cross-site scripting vulnerability was discovered in a project collaboration application. An outside collaborator could store a message containing malicious HTML within an attachment content attribute that appeared as a normal embed when viewed. When an account administrato...

Basecamp: Cross-account XSS on app.basecamp.com: oEmbed option injection chained through Turbo defeats the CSP nonce

A cross-account cross-site scripting vulnerability was discovered on an embed display page. The page rendered HTML returned by embed providers without proper host validation. The security check compared registrable domains incorrectly, allowing requests from application hosts that should have bee...