# XSS on www.mapbox.com/authorize

Mapbox /authorize renders redirect_uri unescaped into an anchor href when client_id is missing, enabling reflected XSS via a quote-breakout SVG payload.

- Payout: hidden
- Severity: medium
- Program: Mapbox
- Found by: stefanovettorazzi
- Disclosed: 2017-08-14
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/143220
- Library page: https://bugbountylibrary.com/r/h1%3A143220
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:nodejs vuln:xss

**Target:** OAuth authorize endpoint (www.mapbox.com/authorize)
**Root cause:** The unauthorized modal template interpolates obj.redirect into an anchor href with `<%= %>` (unescaped) instead of `<%- %>`/escaping, and authorize.js passes the raw redirect_uri query param into that field when client_id is absent.
**Steps:**
1. Request https://www.mapbox.com/authorize/ without the client_id parameter so the template-modal-unauthorized view renders.
2. Supply redirect_uri containing a quote-breakout payload: `https://www.mapbox.com/authorize/?redirect_uri=%27%3E%3Csvg%20onload=%27alert%28document.domain%29%27%3E`.
3. The value is inserted into `<a href='<%= obj.redirect %>'>`, breaking out of the attribute and tag to inject `<svg onload='alert(document.domain)'>`.
4. Load the URL in a browser; the SVG onload fires the script in the mapbox.com origin.
**How found:** Noticed the unauthorized template uses unescaped `<%= %>` interpolation for obj.redirect and traced authorize.js passing the raw redirect_uri param into it when client_id is missing.
**Exploitation:** Victim clicks a crafted /authorize link lacking client_id; the unauthorized modal renders the attacker-controlled redirect_uri as HTML, executing script in the www.mapbox.com origin.
**Insight:** On OAuth authorize endpoints, test the error/unauthorized branches (missing client_id, invalid params) — fallback templates often interpolate redirect_uri or error_description unescaped even when the happy path is safe.