# Stored XSS on newsroom.uber.com admin panel / Stream WordPress plugin

Unauthenticated attacker injects JS via Referer into Stream plugin's activity log on newsroom.uber.com, executing stored XSS in admin panel and enabling PHP injection.

- Payout: $5,000
- Severity: high
- Program: Uber
- Credited: jouko
- Disclosed: 2016-07-27
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/127948
- Library page: https://bugbountylibrary.com/r/h1%3A127948
- Tags: domain:web impact:ato impact:rce kind:bounty platform:hackerone sev:high tech:php tech:wordpress technique:chained technique:source-review vuln:xss

**Target:** WordPress Stream plugin activity log on newsroom.uber.com
**Root cause:** Stream's wp_redirect hook logs the 'file' query param from any redirect URL matching plugin-editor.php without sanitizing it, and the admin log view renders it as HTML.
**Steps:**
1. Send `curl -H 'Referer: /hello?plugin-editor.php&file=aaa%3cscript%3ealert(1);%3c/script%3e' --data 'post-password=foo' 'https://newsroom.uber.com/wp-login.php?action=postpass'`
2. wp-login.php postpass redirects to the Referer value, triggering Stream's callback_wp_redirect
3. Stream logs the unsanitized 'file' param into its DB table
4. Admin opens Stream tab in dashboard; stored script executes with admin privileges
**How found:** Code review of Stream's connectors/installer.php revealed the wp_redirect hook logs the 'file' query param unsanitized; researcher then found wp-login.php postpass reflects Referer as a redirect to trigger the log.
**Exploitation:** Unauthenticated request poisons the Stream log via Referer redirect; when an admin views the Stream tab the JS runs as admin, allowing theme/plugin editor abuse to write PHP and compromise the server.
**Escalation:** Stored XSS in admin context chained to PHP code injection via WordPress plugin/theme editors for server-side RCE.
**Insight:** Activity-log/audit plugins that hook redirects and log URL params are a stored-XSS goldmine; find any WordPress endpoint that redirects to attacker-controlled Referer (wp-login.php postpass) to feed the logger without auth.