{"id":43,"date":"2025-06-14T09:18:48","date_gmt":"2025-06-14T09:18:48","guid":{"rendered":"https:\/\/pare.sh\/blog\/?p=43"},"modified":"2025-06-15T09:37:22","modified_gmt":"2025-06-15T09:37:22","slug":"persistent-xss-on-the-mozilla-add-ons-site","status":"publish","type":"post","link":"https:\/\/pare.sh\/blog\/persistent-xss-on-the-mozilla-add-ons-site\/","title":{"rendered":"Persistent XSS on the Mozilla Add-ons Site"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">On 9 February 2016 I was reading an excellent post by Ashar Javed on a persistent XSS in Mozilla Add-ons.<br><em>Reference:<\/em> <a class=\"\" href=\"https:\/\/respectxss.blogspot.de\/2016\/01\/persistent-xss-in-mozilla-add-ons-site.html\">https:\/\/respectxss.blogspot.de\/2016\/01\/persistent-xss-in-mozilla-add-ons-site.html<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Inspired by this idea, I decided to challenge myself with the same target: addons.mozilla.org, but this time focusing specifically on its mobile interface. I chose the mobile version because these pages frequently receive less attention and care when it comes to implementing robust security measures and protections.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">My mobile user-agent of choice:<br><code>Mozilla\/5.0 (Android 4.4; Mobile; rv:41.0) Gecko\/41.0 Firefox\/41.0<br><\/code><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h4 class=\"wp-block-heading\">Scoping the Attack Surface<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">I quickly narrowed my focus to the review section of each add-on, e.g.: <code>https:\/\/addons.mozilla.org\/en-US\/AddonName\/addon\/addonNames\/reviews\/<br><\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you\u2019re logged in, you can submit a star rating and a comment.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h4 class=\"wp-block-heading\">The Payload (&amp; 2-Minute Win)<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">I picked a random add-on, gave it star and submitted this \u201creview\u201d: <br><code>&lt;img src=x onerror=alert(document.domain)><br><\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">the alert popped immediately when I revisited the page. A classic stored XSS in under two minutes. <br><\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"330\" src=\"https:\/\/pare.sh\/blog\/wp-content\/uploads\/2025\/06\/image-1024x330.png\" alt=\"\" class=\"wp-image-44\" srcset=\"https:\/\/pare.sh\/blog\/wp-content\/uploads\/2025\/06\/image-1024x330.png 1024w, https:\/\/pare.sh\/blog\/wp-content\/uploads\/2025\/06\/image-300x97.png 300w, https:\/\/pare.sh\/blog\/wp-content\/uploads\/2025\/06\/image-768x247.png 768w, https:\/\/pare.sh\/blog\/wp-content\/uploads\/2025\/06\/image-1536x495.png 1536w, https:\/\/pare.sh\/blog\/wp-content\/uploads\/2025\/06\/image.png 1853w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h4 class=\"wp-block-heading\">Thinking Bigger: CSRF via XSS<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">A stored XSS on a review page is already bad, but I realised it also let me bypass CSRF protection elsewhere on the same site:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Fetch the target form via <code>XMLHttpRequest<\/code>.<\/li>\n\n\n\n<li>Parse out the fresh CSRF token.<\/li>\n\n\n\n<li>Re-submit the form with malicious data, token included.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Handy references I leaned on:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>MDN <code>XMLHttpRequest<\/code> docs<\/li>\n\n\n\n<li>Riley Kidd\u2019s write-up on XSS-enabled CSRF <a class=\"\" href=\"https:\/\/rileykidd.com\/2013\/09\/09\/using-xss-to-csrf\/\">https:\/\/rileykidd.com\/2013\/09\/09\/using-xss-to-csrf\/<\/a><\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h4 class=\"wp-block-heading\">Disclosure &amp; Response<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">I reported the bug to Mozilla via <strong>Bugzilla<\/strong>.<br>To their credit:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Issue confirmed:<\/strong> ~12 hours after report<\/li>\n\n\n\n<li><strong>Fix deployed:<\/strong> ~48 hours later\n<ul class=\"wp-block-list\">\n<li>Patch: <a class=\"\" href=\"https:\/\/github.com\/mozilla\/addons-server\/commit\/455132c9a104c6907e5208054d0e2187d5d90ca8\">https:\/\/github.com\/mozilla\/addons-server\/commit\/455132c9a104c6907e5208054d0e2187d5d90ca8<\/a><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h4 class=\"wp-block-heading\">Bounty<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">A few days later I received my very first Mozilla bounty.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">Lessons Learned<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Mobile views aren\u2019t second-class targets\u2014they can be a gold mine.<\/li>\n\n\n\n<li>Even simple payloads work when input isn\u2019t sanitised.<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>On 9 February 2016 I was reading an excellent post by Ashar Javed on a persistent XSS in Mozilla Add-ons.Reference: [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[10],"tags":[],"class_list":["post-43","post","type-post","status-publish","format-standard","hentry","category-web"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"On 9 February 2016 I was reading an excellent post by Ashar Javed on a persistent XSS in Mozilla Add-ons.Reference: https:\/\/respectxss.blogspot.de\/2016\/01\/persistent-xss-in-mozilla-add-ons-site.html Inspired by this idea, I decided to challenge myself with the same target: addons.mozilla.org, but this time focusing specifically on its mobile interface. I chose the mobile version because these pages frequently receive less\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"pparmar\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/pare.sh\/blog\/persistent-xss-on-the-mozilla-add-ons-site\/\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Writeups - My WordPress Blog\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"Persistent XSS on the Mozilla Add-ons Site - Writeups\" \/>\n\t\t<meta property=\"og:description\" content=\"On 9 February 2016 I was reading an excellent post by Ashar Javed on a persistent XSS in Mozilla Add-ons.Reference: https:\/\/respectxss.blogspot.de\/2016\/01\/persistent-xss-in-mozilla-add-ons-site.html Inspired by this idea, I decided to challenge myself with the same target: addons.mozilla.org, but this time focusing specifically on its mobile interface. I chose the mobile version because these pages frequently receive less\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/pare.sh\/blog\/persistent-xss-on-the-mozilla-add-ons-site\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/pare.sh\/blog\/wp-content\/uploads\/2025\/06\/ext-custom-logo-1749892156167.webp\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/pare.sh\/blog\/wp-content\/uploads\/2025\/06\/ext-custom-logo-1749892156167.webp\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2025-06-14T09:18:48+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2025-06-15T09:37:22+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:title\" content=\"Persistent XSS on the Mozilla Add-ons Site - Writeups\" \/>\n\t\t<meta name=\"twitter:description\" content=\"On 9 February 2016 I was reading an excellent post by Ashar Javed on a persistent XSS in Mozilla Add-ons.Reference: https:\/\/respectxss.blogspot.de\/2016\/01\/persistent-xss-in-mozilla-add-ons-site.html Inspired by this idea, I decided to challenge myself with the same target: addons.mozilla.org, but this time focusing specifically on its mobile interface. I chose the mobile version because these pages frequently receive less\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/pare.sh\/blog\/wp-content\/uploads\/2025\/06\/ext-custom-logo-1749892156167.webp\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BlogPosting\",\"@id\":\"https:\\\/\\\/pare.sh\\\/blog\\\/persistent-xss-on-the-mozilla-add-ons-site\\\/#blogposting\",\"name\":\"Persistent XSS on the Mozilla Add-ons Site - Writeups\",\"headline\":\"Persistent XSS on the Mozilla Add-ons Site\",\"author\":{\"@id\":\"https:\\\/\\\/pare.sh\\\/blog\\\/author\\\/pparmar\\\/#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/pare.sh\\\/blog\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/pare.sh\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/06\\\/image.png\",\"@id\":\"https:\\\/\\\/pare.sh\\\/blog\\\/persistent-xss-on-the-mozilla-add-ons-site\\\/#articleImage\",\"width\":1853,\"height\":597},\"datePublished\":\"2025-06-14T09:18:48+00:00\",\"dateModified\":\"2025-06-15T09:37:22+00:00\",\"inLanguage\":\"en-US\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/pare.sh\\\/blog\\\/persistent-xss-on-the-mozilla-add-ons-site\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/pare.sh\\\/blog\\\/persistent-xss-on-the-mozilla-add-ons-site\\\/#webpage\"},\"articleSection\":\"Web\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/pare.sh\\\/blog\\\/persistent-xss-on-the-mozilla-add-ons-site\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/pare.sh\\\/blog#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/pare.sh\\\/blog\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/pare.sh\\\/blog\\\/category\\\/web\\\/#listItem\",\"name\":\"Web\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/pare.sh\\\/blog\\\/category\\\/web\\\/#listItem\",\"position\":2,\"name\":\"Web\",\"item\":\"https:\\\/\\\/pare.sh\\\/blog\\\/category\\\/web\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/pare.sh\\\/blog\\\/persistent-xss-on-the-mozilla-add-ons-site\\\/#listItem\",\"name\":\"Persistent XSS on the Mozilla Add-ons Site\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/pare.sh\\\/blog#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/pare.sh\\\/blog\\\/persistent-xss-on-the-mozilla-add-ons-site\\\/#listItem\",\"position\":3,\"name\":\"Persistent XSS on the Mozilla Add-ons Site\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/pare.sh\\\/blog\\\/category\\\/web\\\/#listItem\",\"name\":\"Web\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/pare.sh\\\/blog\\\/#organization\",\"name\":\"Writeups\",\"description\":\"My WordPress Blog\",\"url\":\"https:\\\/\\\/pare.sh\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/pare.sh\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/06\\\/ext-custom-logo-1749892156167.webp\",\"@id\":\"https:\\\/\\\/pare.sh\\\/blog\\\/persistent-xss-on-the-mozilla-add-ons-site\\\/#organizationLogo\",\"width\":256,\"height\":256},\"image\":{\"@id\":\"https:\\\/\\\/pare.sh\\\/blog\\\/persistent-xss-on-the-mozilla-add-ons-site\\\/#organizationLogo\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/pare.sh\\\/blog\\\/author\\\/pparmar\\\/#author\",\"url\":\"https:\\\/\\\/pare.sh\\\/blog\\\/author\\\/pparmar\\\/\",\"name\":\"pparmar\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/pare.sh\\\/blog\\\/persistent-xss-on-the-mozilla-add-ons-site\\\/#authorImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2d67a8573bea169cb0b6c421c4c1d46c7bc3222911154183b49c87d6c0d0bb08?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"pparmar\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/pare.sh\\\/blog\\\/persistent-xss-on-the-mozilla-add-ons-site\\\/#webpage\",\"url\":\"https:\\\/\\\/pare.sh\\\/blog\\\/persistent-xss-on-the-mozilla-add-ons-site\\\/\",\"name\":\"Persistent XSS on the Mozilla Add-ons Site - Writeups\",\"description\":\"On 9 February 2016 I was reading an excellent post by Ashar Javed on a persistent XSS in Mozilla Add-ons.Reference: https:\\\/\\\/respectxss.blogspot.de\\\/2016\\\/01\\\/persistent-xss-in-mozilla-add-ons-site.html Inspired by this idea, I decided to challenge myself with the same target: addons.mozilla.org, but this time focusing specifically on its mobile interface. I chose the mobile version because these pages frequently receive less\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/pare.sh\\\/blog\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/pare.sh\\\/blog\\\/persistent-xss-on-the-mozilla-add-ons-site\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/pare.sh\\\/blog\\\/author\\\/pparmar\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/pare.sh\\\/blog\\\/author\\\/pparmar\\\/#author\"},\"datePublished\":\"2025-06-14T09:18:48+00:00\",\"dateModified\":\"2025-06-15T09:37:22+00:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/pare.sh\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/pare.sh\\\/blog\\\/\",\"name\":\"Writeups\",\"description\":\"My WordPress Blog\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/pare.sh\\\/blog\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"Persistent XSS on the Mozilla Add-ons Site - Writeups","description":"On 9 February 2016 I was reading an excellent post by Ashar Javed on a persistent XSS in Mozilla Add-ons.Reference: https:\/\/respectxss.blogspot.de\/2016\/01\/persistent-xss-in-mozilla-add-ons-site.html Inspired by this idea, I decided to challenge myself with the same target: addons.mozilla.org, but this time focusing specifically on its mobile interface. I chose the mobile version because these pages frequently receive less","canonical_url":"https:\/\/pare.sh\/blog\/persistent-xss-on-the-mozilla-add-ons-site\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BlogPosting","@id":"https:\/\/pare.sh\/blog\/persistent-xss-on-the-mozilla-add-ons-site\/#blogposting","name":"Persistent XSS on the Mozilla Add-ons Site - Writeups","headline":"Persistent XSS on the Mozilla Add-ons Site","author":{"@id":"https:\/\/pare.sh\/blog\/author\/pparmar\/#author"},"publisher":{"@id":"https:\/\/pare.sh\/blog\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/pare.sh\/blog\/wp-content\/uploads\/2025\/06\/image.png","@id":"https:\/\/pare.sh\/blog\/persistent-xss-on-the-mozilla-add-ons-site\/#articleImage","width":1853,"height":597},"datePublished":"2025-06-14T09:18:48+00:00","dateModified":"2025-06-15T09:37:22+00:00","inLanguage":"en-US","mainEntityOfPage":{"@id":"https:\/\/pare.sh\/blog\/persistent-xss-on-the-mozilla-add-ons-site\/#webpage"},"isPartOf":{"@id":"https:\/\/pare.sh\/blog\/persistent-xss-on-the-mozilla-add-ons-site\/#webpage"},"articleSection":"Web"},{"@type":"BreadcrumbList","@id":"https:\/\/pare.sh\/blog\/persistent-xss-on-the-mozilla-add-ons-site\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/pare.sh\/blog#listItem","position":1,"name":"Home","item":"https:\/\/pare.sh\/blog","nextItem":{"@type":"ListItem","@id":"https:\/\/pare.sh\/blog\/category\/web\/#listItem","name":"Web"}},{"@type":"ListItem","@id":"https:\/\/pare.sh\/blog\/category\/web\/#listItem","position":2,"name":"Web","item":"https:\/\/pare.sh\/blog\/category\/web\/","nextItem":{"@type":"ListItem","@id":"https:\/\/pare.sh\/blog\/persistent-xss-on-the-mozilla-add-ons-site\/#listItem","name":"Persistent XSS on the Mozilla Add-ons Site"},"previousItem":{"@type":"ListItem","@id":"https:\/\/pare.sh\/blog#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/pare.sh\/blog\/persistent-xss-on-the-mozilla-add-ons-site\/#listItem","position":3,"name":"Persistent XSS on the Mozilla Add-ons Site","previousItem":{"@type":"ListItem","@id":"https:\/\/pare.sh\/blog\/category\/web\/#listItem","name":"Web"}}]},{"@type":"Organization","@id":"https:\/\/pare.sh\/blog\/#organization","name":"Writeups","description":"My WordPress Blog","url":"https:\/\/pare.sh\/blog\/","logo":{"@type":"ImageObject","url":"https:\/\/pare.sh\/blog\/wp-content\/uploads\/2025\/06\/ext-custom-logo-1749892156167.webp","@id":"https:\/\/pare.sh\/blog\/persistent-xss-on-the-mozilla-add-ons-site\/#organizationLogo","width":256,"height":256},"image":{"@id":"https:\/\/pare.sh\/blog\/persistent-xss-on-the-mozilla-add-ons-site\/#organizationLogo"}},{"@type":"Person","@id":"https:\/\/pare.sh\/blog\/author\/pparmar\/#author","url":"https:\/\/pare.sh\/blog\/author\/pparmar\/","name":"pparmar","image":{"@type":"ImageObject","@id":"https:\/\/pare.sh\/blog\/persistent-xss-on-the-mozilla-add-ons-site\/#authorImage","url":"https:\/\/secure.gravatar.com\/avatar\/2d67a8573bea169cb0b6c421c4c1d46c7bc3222911154183b49c87d6c0d0bb08?s=96&d=mm&r=g","width":96,"height":96,"caption":"pparmar"}},{"@type":"WebPage","@id":"https:\/\/pare.sh\/blog\/persistent-xss-on-the-mozilla-add-ons-site\/#webpage","url":"https:\/\/pare.sh\/blog\/persistent-xss-on-the-mozilla-add-ons-site\/","name":"Persistent XSS on the Mozilla Add-ons Site - Writeups","description":"On 9 February 2016 I was reading an excellent post by Ashar Javed on a persistent XSS in Mozilla Add-ons.Reference: https:\/\/respectxss.blogspot.de\/2016\/01\/persistent-xss-in-mozilla-add-ons-site.html Inspired by this idea, I decided to challenge myself with the same target: addons.mozilla.org, but this time focusing specifically on its mobile interface. I chose the mobile version because these pages frequently receive less","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/pare.sh\/blog\/#website"},"breadcrumb":{"@id":"https:\/\/pare.sh\/blog\/persistent-xss-on-the-mozilla-add-ons-site\/#breadcrumblist"},"author":{"@id":"https:\/\/pare.sh\/blog\/author\/pparmar\/#author"},"creator":{"@id":"https:\/\/pare.sh\/blog\/author\/pparmar\/#author"},"datePublished":"2025-06-14T09:18:48+00:00","dateModified":"2025-06-15T09:37:22+00:00"},{"@type":"WebSite","@id":"https:\/\/pare.sh\/blog\/#website","url":"https:\/\/pare.sh\/blog\/","name":"Writeups","description":"My WordPress Blog","inLanguage":"en-US","publisher":{"@id":"https:\/\/pare.sh\/blog\/#organization"}}]},"og:locale":"en_US","og:site_name":"Writeups - My WordPress Blog","og:type":"article","og:title":"Persistent XSS on the Mozilla Add-ons Site - Writeups","og:description":"On 9 February 2016 I was reading an excellent post by Ashar Javed on a persistent XSS in Mozilla Add-ons.Reference: https:\/\/respectxss.blogspot.de\/2016\/01\/persistent-xss-in-mozilla-add-ons-site.html Inspired by this idea, I decided to challenge myself with the same target: addons.mozilla.org, but this time focusing specifically on its mobile interface. I chose the mobile version because these pages frequently receive less","og:url":"https:\/\/pare.sh\/blog\/persistent-xss-on-the-mozilla-add-ons-site\/","og:image":"https:\/\/pare.sh\/blog\/wp-content\/uploads\/2025\/06\/ext-custom-logo-1749892156167.webp","og:image:secure_url":"https:\/\/pare.sh\/blog\/wp-content\/uploads\/2025\/06\/ext-custom-logo-1749892156167.webp","article:published_time":"2025-06-14T09:18:48+00:00","article:modified_time":"2025-06-15T09:37:22+00:00","twitter:card":"summary_large_image","twitter:title":"Persistent XSS on the Mozilla Add-ons Site - Writeups","twitter:description":"On 9 February 2016 I was reading an excellent post by Ashar Javed on a persistent XSS in Mozilla Add-ons.Reference: https:\/\/respectxss.blogspot.de\/2016\/01\/persistent-xss-in-mozilla-add-ons-site.html Inspired by this idea, I decided to challenge myself with the same target: addons.mozilla.org, but this time focusing specifically on its mobile interface. I chose the mobile version because these pages frequently receive less","twitter:image":"https:\/\/pare.sh\/blog\/wp-content\/uploads\/2025\/06\/ext-custom-logo-1749892156167.webp"},"aioseo_meta_data":{"post_id":"43","title":null,"description":null,"keywords":null,"keyphrases":{"focus":{"keyphrase":"","score":0,"analysis":{"keyphraseInTitle":{"score":0,"maxScore":9,"error":1}}},"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"BlogPosting","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":null,"frequency":"default","local_seo":null,"breadcrumb_settings":null,"limit_modified_date":false,"ai":null,"created":"2025-06-14 09:18:48","updated":"2025-06-15 09:38:35","seo_analyzer_scan_date":null,"focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/pare.sh\/blog\" title=\"Home\">Home<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/pare.sh\/blog\/category\/web\/\" title=\"Web\">Web<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\tPersistent XSS on the Mozilla Add-ons Site\n\t\t<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/pare.sh\/blog"},{"label":"Web","link":"https:\/\/pare.sh\/blog\/category\/web\/"},{"label":"Persistent XSS on the Mozilla Add-ons Site","link":"https:\/\/pare.sh\/blog\/persistent-xss-on-the-mozilla-add-ons-site\/"}],"_links":{"self":[{"href":"https:\/\/pare.sh\/blog\/wp-json\/wp\/v2\/posts\/43","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/pare.sh\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pare.sh\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pare.sh\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/pare.sh\/blog\/wp-json\/wp\/v2\/comments?post=43"}],"version-history":[{"count":1,"href":"https:\/\/pare.sh\/blog\/wp-json\/wp\/v2\/posts\/43\/revisions"}],"predecessor-version":[{"id":45,"href":"https:\/\/pare.sh\/blog\/wp-json\/wp\/v2\/posts\/43\/revisions\/45"}],"wp:attachment":[{"href":"https:\/\/pare.sh\/blog\/wp-json\/wp\/v2\/media?parent=43"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pare.sh\/blog\/wp-json\/wp\/v2\/categories?post=43"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pare.sh\/blog\/wp-json\/wp\/v2\/tags?post=43"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}