# Stored XSS in message.alibaba.com ($2,000)

Stored XSS in Alibaba Message chat via HTML entity-encoded javascript: URI in <object data>, then bypassed a naive filter by splitting 'onclick' with 'javascript:' to re-form the handler.

- Payout: $2,000
- Severity: medium
- Program: Alibaba
- Credited: R ando
- Disclosed: 2022-02-18
- Write-up quality: 6/10
- Original: https://web.archive.org/web/20220220072733/https://bloggerrando.blogspot.com/2022/02/stored-xss-on-messagealibabacom-alibaba.html
- Library page: https://bugbountylibrary.com/r/blog%3Aweb-archive-org-web-20220220072733-https-bloggerrando-blogspot-com-2022-02-stored-xss-on-messagealibabacom-alibaba-html
- Tags: domain:web impact:integrity kind:bounty platform:blog sev:medium technique:incomplete-fix technique:source-review vuln:xss

**Target:** message.alibaba.com chat message rendering
**Root cause:** Chat messages render attacker HTML; the sanitizer decodes HTML entities (javascript&colon;) into a javascript: URI in <object data>, and its keyword stripping of 'javascript:' can be defeated by inserting the removed token inside an event handler name to reconstruct 'onclick'.
**Steps:**
1. Open Alibaba Message and a victim chat
2. Send `<object data=javascript&colon;alert&lpar;document.domain)>` to trigger stored XSS
3. After fix, send `test<img src=x oncjavascript:lick=prompt(1)>test`
4. Filter strips 'javascript:' leaving `onclick=prompt(1)` which executes on click
**How found:** Researcher tested HTML entity encoding to smuggle a javascript: URI past the filter, then probed the sanitizer's keyword blacklist by observing that 'javascript:' was stripped and hypothesizing that inserting the stripped token inside an attribute name would reconstruct a working handler.
**Exploitation:** Attacker sends a crafted chat message to a victim; the payload persists and executes in the victim's session on message render/click, allowing script execution in the message.alibaba.com origin (document.domain shown via alert/prompt).
**Insight:** When a sanitizer strips a keyword like 'javascript:' rather than rejecting the input, try embedding that exact token inside an attribute/handler name so removal re-forms a valid handler (e.g. oncjavascript:lick -> onclick); also test HTML entity encoding (&colon;, &lpar;) to bypass URI scheme checks.