160 German tax office sites vulnerable to XSS

11 November 2013 1 min read Patrik Grobshäuser Archive

Research summary

Reflected cross-site scripting across 160 German tax office websites, disclosed via heise.de and forwarded to CERT-Bund for coordinated remediation.

Products: German Finanzämter, heise.de, CERT-Bund
Vulnerability: Reflected XSS

Published in 2013. Product behaviour and tooling described here reflect that time.

We found 160 websites belonging to German tax offices (Finanzämter) vulnerable to reflected cross-site scripting. We passed the information to the German IT news site heise.de, which forwarded it to CERT-Bund, the German government Computer Emergency Response Team.