# Stored XSS on www.hackerone.com due to deleted S3-bucket from old page_widget

Deleted S3 bucket referenced by an old Uberflip page_widget on www.hackerone.com was claimable, letting attacker run JS and phish apex-domain credentials.

- Payout: hidden
- Severity: medium
- Program: HackerOne
- Found by: fransrosen
- Disclosed: 2023-03-10
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/1598347
- Library page: https://bugbountylibrary.com/r/h1%3A1598347
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:medium tech:s3 technique:recon technique:source-review vuln:misconfiguration vuln:subdomain-takeover vuln:xss

**Target:** www.hackerone.com proxied Uberflip page_widget endpoint
**Root cause:** An old Uberflip page_widget embedded a script tag loading vspoverlayrun1.js from the S3 bucket 'vspcode', which no longer existed and could be re-registered by anyone.
**Steps:**
1. Enumerate Uberflip page widgets at `/read/page_widget/XXX` on the proxied www.hackerone.com host
2. Find widget 413780 loading `https://s3.amazonaws.com/vspcode/vspoverlayrun1.js` over HTTPS
3. `aws s3api create-bucket --bucket vspcode` to claim the deleted bucket
4. Upload `vspoverlayrun1.js` with `alert(document.domain)` and `--acl public-read`
5. Visit `https://www.hackerone.com/resources/read/page_widget/413780` to execute JS in origin
**How found:** Noticed Uberflip isolates hubs by custom domain, but discovered legacy cross-customer page_widget endpoints; filtered widgets by HTTPS-loaded JS and found one referencing a nonexistent S3 bucket.
**Exploitation:** Attacker claims the dangling S3 bucket, hosts arbitrary JS, then replaces page content with a fake hackerone.com sign-in form using history.pushState and exfiltrates form data via Image beacon to attacker host; password managers autofill apex credentials on www.
**Escalation:** Leveraged www-vs-apex origin trust so password managers autofill hackerone.com credentials into the injected form, turning XSS into credential phishing.
**Insight:** When a target proxies a third-party SaaS (Uberflip), enumerate legacy cross-tenant endpoints like /read/page_widget/ID and grep their HTML for external script srcs pointing at S3/CDN buckets that may be deleted and re-claimable.