# Reflected XSS on developer.uber.com via Angular template injection

Reflected XSS on developer.uber.com via Angular client-side template injection in the q parameter, escaping the sandbox to execute arbitrary JS and hijack developer accounts.

- Payout: $3,000
- Severity: high
- Program: Uber
- Credited: albinowax
- Disclosed: 2016-04-04
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/125027
- Library page: https://bugbountylibrary.com/r/h1%3A125027
- Tags: domain:web impact:ato kind:bounty platform:hackerone sev:high technique:source-review vuln:ssti vuln:xss

**Target:** developer.uber.com docs page q parameter (Angular client-side template)
**Root cause:** User input from the q query parameter is dynamically embedded into an Angular-rendered page, so Angular evaluates template expressions in the input.
**Steps:**
1. Visit `https://developer.uber.com/docs/deep-linking?q=wrtz{{7*7}}`
2. Observe rendered source contains `wrtz49`, confirming expression evaluation
3. Use Angular sandbox escape payload `?q=wrtz{{(_="".sub).call.call({}[$="constructor"].getOwnPropertyDescriptor(_.__proto__,$).value,0,"alert(1)")()}}zzzz`
4. Load in IE11 to trigger alert(1)
**How found:** Researcher tested whether the q parameter was reflected into an Angular template by injecting `{{7*7}}` and checking for `49` in rendered source, then applied a known Angular sandbox escape.
**Exploitation:** Attacker crafts a URL with an Angular template expression that escapes the sandbox and executes arbitrary JavaScript in the victim's browser; victim must click the link, enabling session/account hijack of developer accounts and their apps.
**Insight:** When a reflected parameter lands in a page rendered by Angular, test `{{7*7}}` and inspect rendered (not raw) source for evaluation; Angular sandbox escapes can yield full XSS even without HTML injection.