# XSS in SocialIcon Link

Stored XSS via unvalidated javascript: URI in Linktree SocialIcon link; HttpOnly cookies blocked theft, so attacker fetched /api/token to leak accessToken.

- Payout: hidden
- Severity: high
- Program: Linktree
- Found by: sudi
- Disclosed: 2022-10-31
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1698652
- Library page: https://bugbountylibrary.com/r/h1%3A1698652
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:high tech:rest technique:source-review vuln:info-disclosure vuln:xss

**Target:** SocialIcon link URL field on linktr.ee profile
**Root cause:** The SocialIcon link URL was not validated, allowing a javascript: URI to be stored and executed when the profile rendered.
**Steps:**
1. Set SocialIcon link URL to `javascript://https://amazon.com/shop/x%0Aeval("(async()=>{await fetch('https://linktr.ee/api/token').then(r=>r.json()).then(j=>{alert(j['accessToken']);})})()")`
2. Save profile and load the public page
3. Payload executes; fetch `/api/token` with credentials include returns accessToken
4. Exfiltrate token to attacker endpoint via pipedream webhook
**How found:** Researcher noticed the SocialIcon URL lacked validation and could accept a javascript: URI; after confirming HttpOnly cookies prevented direct theft, they searched for an endpoint returning the auth token and found `/api/token`.
**Exploitation:** Stored javascript: URI executes in victim context; since session cookies are HttpOnly, attacker instead calls the same-origin `/api/token` endpoint with credentials to retrieve the accessToken and exfiltrates it, enabling account takeover.
**Escalation:** Pivoted from blocked cookie theft to leaking a same-origin API token endpoint to achieve account takeover.
**Insight:** When HttpOnly blocks cookie theft, enumerate same-origin API endpoints that return bearer tokens or session material (e.g. /api/token) and call them with credentials:include from the XSS payload.