# Reflected cross-site scripting (XSS) on api.tiles.mapbox.com

Reflected XSS in access_token param of Mapbox v4 map embed page via unescaped underscore template interpolation, executing JS in Firefox users' context.

- Payout: $1,000
- Severity: medium
- Program: Mapbox
- Credited: dawgyg
- Disclosed: 2016-06-01
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/135217
- Library page: https://bugbountylibrary.com/r/h1%3A135217
- Tags: domain:web impact:integrity kind:bounty platform:hackerone sev:medium technique:source-review vuln:xss

**Target:** api.tiles.mapbox.com /v4/.../page.html access_token query parameter
**Root cause:** Underscore template used `<%=` (unescaped interpolation) to render the access_token into meta HTML elements, and Firefox does not encodeURIComponent the single quote in the address bar, allowing breakout.
**Steps:**
1. Craft URL with access_token containing `'><script>alert(document.domain)</script>` (URL-encoded `%27%3E%3Cscript%3E...`)
2. Load `http://api.tiles.mapbox.com/v4/ctswebrequest.m4ga59jd/page.html?access_token=<payload>#11/39.9168/-75.1595` in Firefox
3. Single quote breaks out of meta element; injected script executes in page context
**How found:** Researcher noticed the access_token parameter was reflected into the page and tested quote breakout; recognized Firefox's address-bar behavior of not encoding single quotes enabled the injection.
**Exploitation:** Attacker sends crafted link to a Firefox victim; the unescaped access_token is interpolated into meta tags, the single quote closes the attribute, and the injected script tag runs in the api.mapbox.com origin context.
**Insight:** When a reflected param lands inside HTML attributes, test single-quote breakout specifically in Firefox, which leaves `'` unencoded in the URL bar — a browser-differential that bypasses assumptions about URL encoding.