# XSS in editor by any user

Phabricator's meme markup nested-parsed the src attribute as a link, letting any user inject an onerror handler and execute JavaScript in the editor.

- Payout: $1,000
- Severity: high
- Program: Phabricator
- Credited: tunnelshade
- Disclosed: 2014-08-13
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/18691
- Library page: https://bugbountylibrary.com/r/h1%3A18691
- Tags: domain:web impact:integrity kind:bounty platform:hackerone sev:high tech:php technique:chained vuln:xss

**Target:** Meme markup / editor rendering (Remarkup)
**Root cause:** Nested parsing: the meme rule's src value was re-parsed as a link by the fabricator, and `\\` acted as space separators, breaking out of the attribute context so an onerror handler landed in the generated HTML.
**Steps:**
1. Open any Phabricator editor supporting memes
2. Insert `{meme, src= http://dummy//onerror=eval(prompt(1))// }`
3. Save/render the content
4. JavaScript executes via the injected onerror handler
**How found:** Researcher noticed the meme src value was being auto-linkified (nested parsing) and that `\\` were treated as space separators, then crafted a value that escaped the attribute context.
**Exploitation:** Any user posts the crafted meme markup; when the content is rendered, the src value is turned into a link and the `//onerror=...` payload breaks out, executing script in the viewer's context.
**Insight:** When a markup rule's attribute value is re-parsed by a second formatter (auto-linkifier), try injecting attribute-breaking characters and alternate separators (`//`, `\\`) to escape the generated HTML context.