[ThePenumbra]

Good job on finding that. Would report it to them if I were you.

[ThePenumbra]

It's POST XSS mate. Pretty much useless.

Sorry Haxxy baby, but are you dumb o.o?
I can make a link which on click auto-submits a POST request.
OP, got skype/xmpp?
If yes, PM me it.

[ThePenumbra]

Harder to use, yes, but it's more dangerous as you don't see it in the requested URL. Either way this should be reported to Mojang, maybe you'll get some money for finding the exploit.

Why is it harder to use?
It's really easy.
Make a form, use js to auto-submit it.
Ez fucking pz.

[Angel-sama❤️]

Wow what a great find. I've been trying to do something with it so far. :)

[ThePenumbra]

That form has CSRF protection and your auto-submit thing would never work.

Didn't notice that. I guess i'll look around the site in abit.

[ThePenumbra]

No, that won't work at all. Rifk

Why not?

This is true, but if the website i.e. has no other vulnerability (which you may could use in combination to auto-launch the XSS),
AND further is even CSRF protected, then there is no real chance for a propper exploitation.

Why do you need another vulnerability?
If you have a proper POST XSS without csrf protection in it, you can just upload html with js on another site. You dont need to get the response, you just need to make the request.

[ThePenumbra]

As for this one, there was a CSRF protection.
So as long as you not find another vulnerability, this XSS alone is not pretty much to exploit something interesting from it.

You must be new here, calling HaxOr dumb and explaining me how XSS works 😅
(it's ok though, no problem ;)

Greets, Gee.

If you take a look at my previous post in this thread, I said I didnt notice the CSRF protection.