# Blind XSS in app.pullrequest.com/████████ via /reviews/ratings/{uuid}

Blind XSS via unencoded review rating fields on app.pullrequest.com fired in PullRequest admin portal when an admin reviewed the submission.

- Payout: hidden
- Severity: high
- Program: HackerOne
- Found by: bugra
- Disclosed: 2022-05-25
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1558010
- Library page: https://bugbountylibrary.com/r/h1%3A1558010
- Tags: area:web domain:web impact:ato impact:internal-access kind:bounty platform:hackerone sev:high technique:blind technique:recon vuln:xss

**Target:** app.pullrequest.com review ratings endpoint
**Root cause:** User-supplied review fields (Disliked_reviewers, Liked_reviewers, Reasons) are stored and rendered in the admin review portal without HTML encoding.
**Steps:**
1. Enumerate archived URLs via `http://web.archive.org/cdx/search/cdx?url=app.pullrequest.com/*&output=text&fl=original&collapse=urlkey`
2. Find `https://app.pullrequest.com/reviews/ratings/6eaa6b75-b958-4530-ba46-0d00cbe74e0b/false`
3. Fill all fields with payload `'"><img src=x id=<b64> onerror=eval(atob(this.id))>`
4. Wait for admin to open the review; blind XSS callback fires to external listener
**How found:** Recon via Wayback Machine CDX enumeration of app.pullrequest.com surfaced a legacy review-ratings endpoint; submitting a blind XSS payload there and waiting for an admin to review it confirmed execution.
**Exploitation:** Stored payload executes in the PullRequest admin portal context when an admin views the submitted review, giving script execution in the admin's session.
**Insight:** Wayback/CDX enumeration of a target's own subdomain can reveal forgotten review/feedback endpoints that feed internal admin dashboards — prime blind XSS sinks because admins, not the submitter, render the input.