Ask HN: Maybe found huge security problem, unsure what to do

Let me just start off saying I'm 100% amateur and I don't really know that much so I could be all wrong.

I was browsing the website and got redirected to a random URL. Tracing the requests back I found that the redirect was caused by improperly sanitized html. The exploit more or less gives you an iframe worth of functionality. This allows for very sophisticated phishing.

Firefox is not vulnerable to this (You might be able to guess what the vuln is from that).

Now this actually pales in comparison to the 2nd exploit I found. I'm significantly less sure this works but I'm still pretty sure it will. I have only tested it out on the preview mode and not published.

The preview mode DOES sanitize(hits their server and comes back, basic stuff like gets cleaned up). It just doesn't do a very good job at it. Now, they could have 2 different checks, one being more secure when publishing but this seems unlikely. I'm not really familiar with the applicable laws so I'm not willing to actually publish an attack to test.

The 2nd exploit allows me pretty much free reign on their page. More or less it lets you execute whatever javascript you want.

I have sent the company 2x messages through a form they have for reporting securities vulnerabilities. However I'm not even sure that they got through as I never received a confirmation email (it said one would be sent).

I tried calling as well but I just discovered it last night and I haven't gotten through to anyone who knows anything.

My conundrum is this is an EXTREMELY popular website. Top 100 on Alexa, 30bn+ market cap. If this vulnerability is actually real I'm not sure I'm comfortable sitting on the information for a prolonged period of time considering how easy it would be to exploit.

In the meantime I'm going to continue to try and contact the company but I'm not really sure what my next steps should be otherwise.

Look in linkedin for people working in security for that company, and invite them to connect. In the connection message state directly the problem.

Do this with technical people, but also with it managers from the company and its worth sending it to the CEO.

Explain what are the risks (is it persistent xss visible by other users in a forum etc)

These things are only important until some manager says they are important, so try to explain the business and public image risk of the exploit to a high level manager via linkedin in non technical terms, ideally with a demo. If they forward the email to the it department i bet that then they would act.

Last case if responsible disclosure doesnt work after 3 /6 months: public disclosure via some news site. All of the sudden it gets fixed in two days, they end users end up being better off in the long term.

Unpatched exploits that stay there for years are the bread and butter of hackers, and the short term risk introduced by the public disclosure is compensated by the fact the users get protected in the end.

You should be posting with your main account, you know?

At every IT company I ever worked or friends of me worked there were huge security holes. The common thinking of management is, though, that it's under control. Exposing these holes publicly results in getting fired or maybe even getting sued (because usually job contracts prohibit you from doing something that "harms" the company or its image). I don't think there is much that can be done about it. I certainly wouldn't risk my job, decrease the chance to get a job from other companies and knowing that for all that I could only free the world from one security bug, when million new ones are created daily.

To be clear I don't work for the company. I just happened across it while on their website. More or less I got suspiciously redirected from one of their listings and I started digging from there.