# DOM based reflected XSS in rockstargames.com/newswire/tags through cross domain ajax request

DOM XSS in Rockstar newswire tags: path traversal in tags param reaches a JSONP endpoint whose callback executes attacker JS.

- Payout: hidden
- Severity: medium
- Program: Rockstar Games
- Found by: zombiehelp54
- Disclosed: 2017-03-17
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/172843
- Library page: https://bugbountylibrary.com/r/h1%3A172843
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium technique:chained vuln:path-traversal vuln:xss

**Target:** rockstargames.com/newswire/tags DOM XHR endpoint
**Root cause:** The tags hash parameter is concatenated into an XHR URL to /newswire/tagContent/[tags]/1 and the response is rendered; path traversal in the param reaches a JSONP endpoint returning application/javascript, which executes.
**Steps:**
1. Load `http://www.rockstargames.com/newswire/tags#/?tags=\%2e%2e\%2e%2e\%2e%2e\comments_dal\users\getGlobalLoginSettings%2ejson?callback=alert(%2fxss%2f);%2f%2f`
2. The tags value is requested via XHR to `/newswire/tagContent/[tags_param]/1`
3. Traversal `../../../comments_dal/users/getGlobalLoginSettings.json` redirects the fetch to the JSONP endpoint
4. `?callback=alert(/xss/);//` makes the response application/javascript that executes
**How found:** Noticed the tags param is reflected into an XHR URL and response rendered; observed application/javascript responses execute; dug for an endpoint returning a callback and found getGlobalLoginSettings.json.
**Exploitation:** Victim opens crafted URL; the page's XHR fetches the JSONP endpoint via traversal and the callback runs attacker JS in rockstargames.com origin.
**Insight:** When a hash param feeds an XHR path, try path traversal to reach JSONP/JSON endpoints that reflect a callback and return application/javascript — the content-type turns reflected data into executable script.