# XSS via React element spoofing

Imgur vidgif ticket page reflected query params into a React element, letting a spoofed React element inject HTML and execute XSS.

- Payout: hidden
- Severity: high
- Program: Imgur
- Found by: jouko
- Disclosed: 2016-03-23
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/124277
- Library page: https://bugbountylibrary.com/r/h1%3A124277
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:high tech:react technique:param-pollution vuln:xss

**Target:** vidgif ticket page (React-rendered web endpoint)
**Root cause:** Query parameters were passed into a React element's props, and by supplying `_isReactElement=true` plus `dangerouslySetInnerHTML.__html`, the attacker spoofed a React element that rendered raw HTML.
**Steps:**
1. Visit `http://imgur.com/vidgif/ticket/aaaaaaaa?error[props][dangerouslySetInnerHTML][__html]=%3Cimg%20src=a%20onerror=%22alert(%27XSS%20on%20%27%2bdocument.domain)%22%3E&error[_isReactElement]=true&error[type]=body`
2. The `error` param is treated as a React element due to `_isReactElement=true`
3. `dangerouslySetInnerHTML.__html` injects the `<img onerror>` payload, executing JS in the victim's session
**How found:** Recognized that user-controlled query params were being fed into React element props; applied the known React element spoofing technique (referenced danlec.com blog and H1 report 49652) to forge a React element with dangerouslySetInnerHTML.
**Exploitation:** Attacker crafts a malicious link; victim visiting it executes arbitrary JS in the imgur.com origin, allowing actions on the victim's behalf and access to the IMGURSESSION cookie.
**Insight:** When a React app passes URL/query params into element props, try `_isReactElement=true` plus `props.dangerouslySetInnerHTML.__html` to spoof a React element and bypass escaping.