# [Swiftype] - Stored XSS via document field `url` triggers on `https://app.swiftype.com/engines/<engine>/document_types/<type>/documents/<id>`

Stored XSS in Swiftype document `url` field: javascript: payload rendered as clickable link in admin document view, executing on click.

- Payout: hidden
- Severity: high
- Program: Elastic
- Found by: superman85
- Disclosed: 2021-08-03
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1245787
- Library page: https://bugbountylibrary.com/r/h1%3A1245787
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:high tech:rest technique:source-review vuln:xss

**Target:** app.swiftype.com document detail view / documents API
**Root cause:** The `url` (and `thumbnail_url`) document field accepts arbitrary values including `javascript:` scheme, and the admin UI renders it as a clickable link without scheme validation.
**Steps:**
1. Create API-based engine (e.g. engine 123, document_type test) and get API key.
2. POST to `https://api.swiftype.com/api/v1/engines/123/document_types/test/documents.json` with `url` and `thumbnail_url` fields set to `javascript:alert(1)`.
3. Open Manage -> Content, click the created document ID.
4. Click the `View on your site` link rendered as `http://javascript:alert(1)`; script executes.
**How found:** Researcher reviewed the API-based engine document schema, noticed the `url` field is user-controlled and rendered as a link in the admin UI, and tested a javascript: scheme payload.
**Exploitation:** Attacker with API access indexes a document whose url field is a javascript: URI; when an admin views the document detail and clicks the link, the payload runs in the app.swiftype.com origin, enabling session theft.
**Insight:** In search/indexing products, user-supplied document fields (url, thumbnail_url) get rendered as links in the admin dashboard; test javascript:/data: schemes in any field the UI hyperlinks.