# Stored XSS in developer.uber.com

Stored XSS via Angular template injection in readme.io suggested-edit descriptions let an attacker execute JS on developer.uber.com docs, hijacking developer accounts.

- Payout: $7,500
- Severity: high
- Program: Uber
- Credited: albinowax
- Disclosed: 2016-06-27
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/131450
- Library page: https://bugbountylibrary.com/r/h1%3A131450
- Tags: domain:web impact:ato impact:integrity kind:bounty platform:hackerone sev:high tech:nodejs technique:source-review vuln:ssti vuln:xss

**Target:** readme.io documentation platform (uber.readme.io) suggested-edit description field
**Root cause:** readme.io renders suggested-edit descriptions through AngularJS without ng-nonbindable, so Angular template expressions in the description are evaluated as code.
**Steps:**
1. Load `https://uber.readme.io/docs/deep-linking` to obtain a connect.sid cookie
2. POST to `https://uber.readme.io/users/session` with JSON `{"email":...,"password":...,"action":"session"}` to authenticate and get a new connect.sid
3. Load `https://uber.readme.io/docs/deep-linking/edit` with the new cookie to reach 'Suggest edits'
4. Insert payload `{{(_="".sub).call.call({}[$="constructor"].getOwnPropertyDescriptor(_.__proto__,$).value,0,"alert(1)")()}}` into the document body
5. Enter arbitrary description and submit 'suggest edits'
6. Admin views dashboard and clicks the suggestion; payload executes in admin context
**How found:** Researcher noticed readme.io's suggested-edit flow renders user-supplied description content and tested Angular template injection, using a known Angular sandbox-escape payload to confirm execution.
**Exploitation:** Attacker submits a suggested edit containing an Angular sandbox-escape expression; when a readme.io admin opens the suggestion in the dashboard, the JS runs in the admin's session, allowing auto-approval of the edit and persistent XSS on developer.uber.com docs to hijack any developer viewing the page.
**Escalation:** Auto-approving the suggestion via the admin's JS context turns a pending edit into a permanent stored XSS affecting all developer.uber.com documentation visitors.
**Insight:** Documentation platforms (readme.io) that render user-editable content via AngularJS are prime targets for template injection; test suggested-edit/comment fields with Angular sandbox-escape payloads, and check whether the docs domain shares cookies with the main product.