# Stored XSS via AngularJS Injection

Stored XSS in drchrono referral contact address field via AngularJS 1.1.5 template injection, executing attacker JS for any viewer including admins.

- Payout: hidden
- Severity: high
- Program: drchrono
- Found by: yaworsk
- Disclosed: 2016-06-13
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/141463
- Library page: https://bugbountylibrary.com/r/h1%3A141463
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:high technique:source-review vuln:xss

**Target:** Referral contacts address field on /messages/referrals/contacts/
**Root cause:** User-supplied address is rendered inside an AngularJS 1.1.5 template context, so `[[...]]` expressions are evaluated as Angular expressions rather than displayed as text.
**Steps:**
1. Create a doctor account and visit `https://1337test.drchrono.com/messages/referrals/contacts/`
2. Add a new contact
3. In the address field enter `[[constructor.constructor('alert(1)')()]]`
4. Save and reload the contact overview; alert fires
**How found:** Entered `[[5*5]]` in the address field and observed it render as 25, indicating Angular expression evaluation; checked `angular.version` in console to confirm 1.1.5, then crafted a constructor-based payload.
**Exploitation:** Attacker with permission to create a referral contact stores the Angular expression payload in the address field; when any user (including an admin) views the contact overview, the expression evaluates and arbitrary JS runs, allowing cookie theft and account takeover.
**Escalation:** Payload can exfiltrate document.cookie to a remote endpoint, enabling admin account takeover.
**Insight:** Probe text fields with `[[5*5]]` to detect Angular template evaluation; old AngularJS versions (1.1.x) lack sandbox protections, so `constructor.constructor(...)()` yields direct JS execution.