The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
In January 2013, Zscaler confirmed that a page in its login process contained reflected cross-site scripting (XSS). The company said the pre-authentication location meant the flaw could not steal Zscaler customer authentication cookies; an anonymous tipster disputed that assessment. The “glass house” criticism arose because Zscaler was then publicizing an XSS finding in ESPN’s ScoreCenter app.
What happened with the Zscaler XSS vulnerability?
SecurityWeek reported on January 18, 2013, that an anonymous researcher had reported reflected XSS in a Zscaler password-reset function. Zscaler vice president of security research Michael Sutton confirmed the central technical finding: “Zscaler tested the link and can confirm that the page identified does contain a reflected XSS vulnerability.”
Reflected XSS occurs when a website returns attacker-controlled input in a page without handling it safely, potentially causing a visitor’s browser to run unintended script in the context of that site. The report established that the flaw existed; it did not establish that all Zscaler customers were exposed or that credentials had been stolen. SecurityWeek said it could not confirm the anonymous email’s broader claims about 10 million users or credential theft.
Recommended Free Tools
Could the flaw steal session cookies?
The parties disagreed about impact. Sutton said the vulnerable page was on a pre-authentication domain used in the login process, not in the admin console, and that exploitation would therefore not obtain a Zscaler customer’s authentication cookie. He also said, “We appreciate having this brought to our attention.”
#1 Best Overall
The anonymous tipster argued that the issue could be used after authentication and claimed to have demonstrated theft of end-user post-login cookies. SecurityWeek did not independently verify that claim. The defensible conclusion is that the reflected XSS was acknowledged, while the claimed post-login cookie theft was contested—not a confirmed outcome.
Why was Zscaler accused of hypocrisy over ESPN’s XSS?
The criticism was about timing and consistency. Zscaler was promoting its Zscaler Application Profiler (ZAP) with an XSS finding in ESPN’s ScoreCenter mobile app as a case study. The anonymous researcher objected that Zscaler was drawing attention to another company’s XSS while a similar weakness remained in Zscaler’s own login flow.
Rank #2
- Comes with secure packaging
- It can be a gift item
- Easy to read text
| Comparison | Zscaler | ESPN |
|---|---|---|
| Affected surface | Login and password-reset flow | ScoreCenter mobile app |
| Authentication context | Sutton described the affected page as pre-authentication; the tipster claimed post-authenticated use was possible | The report described an app finding, not a comparable login-state dispute |
| Evidence status | Zscaler confirmed reflected XSS; cookie-theft impact remained disputed | Zscaler publicized its finding; the report said ESPN fixed the issue after notification |
The charge was not proof that the two vulnerabilities had the same technical impact or that Zscaler’s customers were compromised. It reflected the contrast between Zscaler’s public criticism-by-example of an XSS flaw elsewhere and the newly disclosed defect on its own site.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What was the disclosure and remediation timeline?
The anonymous researcher said they had intended to notify Zscaler under responsible-disclosure rules, but went public after Zscaler publicized the ESPN issue before ESPN had fixed it. Zscaler said it notified ESPN on Wednesday, and that ESPN fixed the issue on Friday. SecurityWeek reported that Zscaler planned to address its own flaw in a code update that night. The report describes a planned update; it does not independently document the completion of that update.
Rank #3
Was the earlier ZScaler Gateway XSS patched?
Yes, according to a separate May 24, 2012 entry by security researcher Aditya K. Sood. Sood recorded earlier XSS bugs in the ZScaler Gateway Application, said some were responsibly disclosed, and wrote that “The vulnerability is patched now.” This is evidence of a prior disclosure and patch, but it does not establish that those earlier bugs were the same flaw as the January 2013 login-flow issue.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What application-security lesson does the case offer?
Password-reset and login paths deserve routine security testing even when they are accessible before authentication. They accept user input and can expose a site to vulnerabilities such as reflected XSS. Sutton had previously described these kinds of problems as “really simple coding errors” and “Security 101.” The practical takeaway is to include unauthenticated flows in application testing, while assessing a confirmed defect separately from unverified claims about what an attacker could do with it.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
