Snapchat: Bitmoji source code is accessible

hi team, I'm starting my research on snapchat by scanning all sub-domains on all the domains in-scope: snapchat.com, bitmoji.com, etc. Let's look at one of the urls, https://rendering-service.prod.us-east.bitstrips.com/ When I request GET https://rendering-service.prod.us-east.bitstrips.com/ The...

Bitmoji – Your Personal Emoji - Customized SSL, Dangerous filesystem permissions, MIT license vulnerabilities

HackApp vulnerability scanner discovered that application Bitmoji – Your Personal Emoji published at the 'play' market has multiple vulnerabilities...

Snapchat: [render.bitstrips.com] Stored XSS via an incorrect avatar property value

While modifying an avatar, an attacker has the opportunity to submit XSS payloads as its property values. The resulting png file will return a 500 error with the payload in the response body. The response has a text/html content type, which makes the XSS attack possible. PoC: 1. Go to...