# Stored XSS from Display Settings triggered on Save and viewing realtime search demo

Algolia dashboard stored XSS: a JSON attribute name containing an img onerror payload executes when selected for faceting and rendered in explorer and public realtime-search demos.

- Payout: hidden
- Severity: high
- Program: Algolia
- Found by: ctee
- Disclosed: 2016-09-07
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/156387
- Library page: https://bugbountylibrary.com/r/h1%3A156387
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:high tech:rest technique:second-order vuln:xss

**Target:** Algolia dashboard Indices Display settings and realtime-search demo
**Root cause:** Attribute names from indexed JSON records are rendered unescaped in the Display settings faceting selector and downstream explorer/demo pages, allowing HTML injection.
**Steps:**
1. Create a JSON record with attribute `{"<img src=1 onerror=alert(document.domain)>": "XSS attribute"}`
2. Go to Indices -> Display, select the attribute `<img src=1 onerror=alert(document.domain)>` under Attributes for Faceting, click save
3. Observe XSS fires multiple times on the page
4. XSS also fires at `https://www.algolia.com/explorer#?index=index_name`
5. Create a public UI Demo; visiting the public URL `https://www.algolia.com/realtime-search-demo/xsstest` triggers XSS
**Exploitation:** Attacker controls an attribute name in an indexed record; once an admin selects it for faceting, the payload executes in the dashboard and persists to the public explorer and realtime-search demo URLs, executing for any visitor.
**Insight:** Index/record metadata fields (attribute names, facet labels) are often treated as trusted config and rendered raw in admin UIs and public demos; test injecting HTML into schema keys, not just values.