# Self-XSS due to image URL can be eploited via XSSJacking techniques in review email

Self-XSS in Judge.me recommendation image URL, escalated via XSSJacking through an iframe embedded in review-request email preview to execute script in victim context.

- Payout: hidden
- Severity: medium
- Program: Judge.me 
- Found by: penguinshelp
- Disclosed: 2023-02-01
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1397940
- Library page: https://bugbountylibrary.com/r/h1%3A1397940
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:rest technique:chained vuln:clickjacking vuln:xss

**Target:** Reviewer public profile recommendation image URL and review-request email preview
**Root cause:** The recommendation image URL field is not sanitized, allowing an attribute-breaking payload (`?;'onload=alert(document.domain)>`) that executes when the image loads; the email preview permits arbitrary iframes, enabling framing of the victim profile.
**Steps:**
1. Login to reviewer account; add recommendation at `https://judge.me/[ID]?subtab=recommendations&tab=public_profile`
2. Edit recommendation image with payload `https://secure.gravatar.com/avatar/x.png?;'onload=alert(document.domain)>`
3. In Shopify Judge.me app, edit email template text block; add link with display text/url `https://<iframe src="https://judge.me/[TARGET_ID]?tab=public_profile">`
4. Save twice; create and fulfill a draft order for the target reviewer's email
5. Send manual review request via Requests -> Request Dashboard -> Add manual request
6. Victim opens 'Trouble viewing email' full preview; iframe renders victim profile
7. Apply XSSJacking (drag/click) to trigger the onload payload in victim context
**How found:** Noted the profile page sets `X-Frame-Options: SAMEORIGIN` unlike other app pages whitelisting `*.myshopify.com` in CSP, so attacker storefront framing wouldn't work; searched for a Judge.me surface permitting iframes and found the full email preview.
**Exploitation:** Attacker embeds the victim's public profile in an iframe inside a review-request email preview the victim is induced to open, then uses XSSJacking interaction to fire the stored self-XSS payload, executing JS in the judge.me origin.
**Insight:** When CSP/XFO blocks framing on the main app, look for secondary surfaces (email previews, template renderers) that embed user content in iframes; self-XSS becomes exploitable if you can frame the victim's own authenticated page and force interaction.