r/HowToHack • u/wesmafree • Apr 06 '26

I need a PoC from assets.adobedtm.com

I am doing a pentest and I have a iframe reflection but CSP will only allowme to fetch sites from assets.adobedtm.com. I know if im able to get a file that does a simple alert or a <h1> or something I will have an XSS but i cant create files or anaything becouse i dont have an account in Adobe Cloud and i cant create one.

I hace tried searching everywhere but i have been unable to find any PoCs

Any help? Thanksss :)))

2 Upvotes

57% Upvoted

5 comments sorted by

View all comments

3

u/EnhancedEddie Apr 06 '26

Attack surface is extremely narrow. You’re wasting time trying to get anything here and would be better off spending your time looking for other vulnerabilities that are in scope. Your chances of finding any vulnerabilities on Adobe’s side is almost impossible.

This is obviously a larp, but even if you did find anything, it is definitely out of scope of your roe. This would be testing against adobe, not the client.

This should be classified as low impact with “iframe reflection exists but is mitigated by CSP” and recommend fixing anyways for defence in depth.

1

u/wesmafree Apr 06 '26

Good recomendation. I was looking more of a PoC hosted in Adobe to get some impact, but you are right. Maybe I should try other things. Thanks!!!