# Stored XSS in reclamos

Unclosed <p> tags confused MercadoLibre's HTML sanitizer, letting an attacker inject an <audio onerror> tag for stored XSS in messaging.

- Payout: hidden
- Severity: high
- Program: MercadoLibre
- Found by: valent1ne
- Disclosed: 2024-09-09
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/1675516
- Library page: https://bugbountylibrary.com/r/h1%3A1675516
- Tags: area:web domain:web impact:ato impact:mass-exploit kind:bounty platform:hackerone sev:high technique:fuzzing technique:parser-differential vuln:xss

**Target:** General messaging functionality on www.mercadolibre.com.ar
**Root cause:** The HTML sanitizer's parser mishandled multiple unclosed <p> tags, mis-tracking nesting depth and allowing an extra arbitrary tag to slip through unsanitized.
**Steps:**
1. Open the general messaging functionality on www.mercadolibre.com.ar.
2. Send payload `<p><p><p><p><p><p><p><p><audio/src/onerror=alert(document.domain)>.`
3. Observe the sanitizer emits the <audio> tag with onerror intact, executing JS.
4. Increase the count of unclosed <p> tags proportional to the appended tag's size to inject larger tags like <embed> with external HTML/JS.
**How found:** While analyzing the messaging sanitizer, the researcher noticed that sending multiple unclosed <p> tags followed by an extra tag confused the parser, producing unexpected output; they then tuned the number of <p> tags to the payload size to inject larger tags.
**Exploitation:** Attacker sends a crafted message containing many unclosed <p> tags plus an <audio src onerror> (or <embed> with external content); the sanitizer passes the tag through, and the victim's browser executes the JavaScript when viewing the message, enabling wormable spread across users.
**Escalation:** Wormable XSS: payload could self-propagate across multiple users via the messaging functionality.
**Insight:** When a sanitizer allows a tag like <p>, try flooding it with unclosed instances to desync the parser's nesting/depth tracking, then append the malicious tag and scale the count to the payload length.