VulnerabilityPublished 10 Nov 2025

[DISCLOSURE] DoorDash Enabled 5-Year XSS/HTML Injection Flaw via Official Email; VDP Misclassified Report for 15 Months

Source Reddit NetSec

Severity

Critical

Rated by Threat Radar

Data as of 10 Nov 2025, 16:31 UTC

What to do

AI-suggested

1. Implement advanced email filtering solutions that incorporate heuristic and behavioral analysis to detect phishing attempts, even from trusted domains. 2. Employ Domain-based Message Authentication, Reporting & Conformance (DMARC), SPF, and DKIM policies rigorously and monitor for anomalies in email sending patterns. 3. Educate employees and users about the risk of phishing emails, emphasizing caution even when emails appear from trusted sources. 4. Use email client protections such as disabling automatic HTML rendering or enabling safe reading modes to reduce the risk of malicious HTML execution. 5. Monitor and audit DoorDash-related email traffic for unusual patterns or unexpected content. 6. Engage with DoorDash to confirm remediation status and request transparency on patch deployment. 7. For organizations integrating DoorDash services, consider additional verification steps for communications and transactions initiated via email. 8. Review and improve internal vulnerability disclosure and triage processes to prevent misclassification and delays in remediation of critical vulnerabilities.

Description

A critical stored HTML Injection vulnerability existed in DoorDash's email system for five years, allowing any free account to send phishing emails from the trusted no-reply@doordash.com domain. This flaw enabled attackers to bypass typical email security barriers by leveraging a legitimate sender address, significantly increasing the likelihood of successful phishing attacks. The vulnerability was misclassified in DoorDash's HackerOne Vulnerability Disclosure Program (VDP) for 15 months, delaying remediation. Although no known exploits are currently in the wild, the potential for abuse is high due to the trusted nature of the sender domain and the zero-barrier exploitation method. This issue highlights risks in vendor vulnerability management and the importance of accurate triage. European organizations using DoorDash services or receiving emails from this domain could be targeted for phishing campaigns exploiting this flaw. Immediate mitigation involves enhanced email filtering, user awareness, and verification of email authenticity. Countries with high DoorDash usage and significant e-commerce sectors, such as the UK, Germany, and France, are most likely to be affected. The severity is assessed as critical given the impact on confidentiality, integrity, and the ease of exploitation without authentication or user interaction requirements.

Impact

For European organizations, this vulnerability poses a significant risk primarily through phishing attacks that could lead to credential theft, malware installation, or business email compromise. Since the phishing emails would appear to come from a legitimate and trusted DoorDash domain, users are more likely to trust and engage with malicious content, increasing the success rate of social engineering attacks. Organizations with employees who use DoorDash services or receive communications from DoorDash are at heightened risk. The potential compromise of user credentials or the delivery of malware could lead to data breaches, financial fraud, and disruption of business operations. Additionally, the reputational damage to DoorDash and its partners could indirectly affect European businesses relying on their services. The delayed remediation due to misclassification also highlights systemic risks in vulnerability management that could affect supply chain security. Overall, the impact extends beyond DoorDash customers to any entity targeted via phishing leveraging this vulnerability.

Summary

The disclosed vulnerability is a critical stored HTML Injection flaw in DoorDash's email system that persisted for approximately five years. This vulnerability allowed any user with a free DoorDash account to inject malicious HTML content into emails sent from the official no-reply@doordash.com domain. Because these emails originated from a trusted and verified domain, attackers could craft phishing emails that bypassed many traditional email security controls such as spam filters and domain-based message authentication (e.g., DMARC, SPF). The flaw effectively enabled zero-barrier phishing campaigns, as no elevated privileges or complex exploitation steps were required. The vulnerability was reported but misclassified within DoorDash's HackerOne Vulnerability Disclosure Program for 15 months, delaying the patching process. Although there are no known active exploits in the wild, the potential impact is severe due to the trusted sender domain and the ability to deliver malicious payloads directly to recipients’ inboxes. This vulnerability underscores the risks of improper input validation and the critical need for rigorous triage and classification in vulnerability management programs. The lack of patch links suggests remediation may still be pending or undisclosed publicly. The issue was first publicly discussed on Reddit's NetSec community and is considered highly newsworthy due to its critical nature and the long duration it remained unaddressed.

References

Community reviews

Loading reviews…

What to do

Description

AI analysisMachine-generated, updated 10 Nov 2025, 16:31 UTC

Technical details

References

Community reviews

Related threats