# Stored XSS in archive.uber.com Due to Injection of Javascript:alert(0)

Stored XSS on Uber's PyPI mirror archive.uber.com via javascript: URI in setup.py home_page/download_url fields, rendered as clickable link.

- Payout: $3,000
- Severity: medium
- Program: Uber
- Credited: ddworken
- Disclosed: 2016-05-09
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/126906
- Library page: https://bugbountylibrary.com/r/h1%3A126906
- Tags: domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:python technique:source-review vuln:xss

**Target:** archive.uber.com PyPI mirror package listing page
**Root cause:** The mirror rendered package metadata home_page/download_url values directly into <a href> without validating the URI scheme, allowing javascript: URIs.
**Steps:**
1. Publish a PyPI package with `home_page='Javascript: alert(0)'` and `download_url='Javascript: alert(0)'` in setup.py
2. Wait for archive.uber.com mirror to sync the package from PyPI
3. Visit `http://archive.uber.com/pypi/simple/<package>/`
4. Click the `1 home_page` link to trigger `alert(0)`
**How found:** Researcher noticed archive.uber.com mirrors PyPI and renders package metadata; recognized that setup.py home_page/download_url are attacker-controlled and historically abused on PyPI itself (referenced existing PoC package ignore-me-1.0).
**Exploitation:** Attacker publishes a malicious package to PyPI; Uber's mirror syncs it and renders the javascript: URI as a clickable link; victim clicking the home_page link executes attacker JS in archive.uber.com origin.
**Insight:** Mirrors and re-hosts of third-party registries (PyPI, npm, etc.) inherit attacker-controlled metadata; check whether URI fields like home_page/download_url are scheme-validated when rendered as links.