# yelp.com XSS ATO (via login keylogger, link Google account)

Yelp reflected the guvo cookie unescaped and parsed cookies by spaces, letting an attacker smuggle a persistent XSS via the canary parameter to keylog and link a Google account for ATO.

- Payout: hidden
- Severity: high
- Program: Yelp
- Found by: lil_endian
- Disclosed: 2023-08-15
- Write-up quality: 9/10
- Original: https://hackerone.com/reports/2010530
- Library page: https://bugbountylibrary.com/r/h1%3A2010530
- Tags: area:web domain:web impact:ato impact:data-leak kind:bounty platform:hackerone sev:high technique:chained vuln:account-takeover vuln:crlf-injection vuln:xss

**Target:** www.yelp.com / biz.yelp.com login and profile_sharing
**Root cause:** The guvo cookie value is reflected unescaped into window.ySitRepParams and window.yelp.guv, and the backend parses cookies by splitting on spaces instead of semicolons, allowing guvo to be smuggled inside the attacker-settable yelpmainpaastacanary cookie.
**Steps:**
1. Set yelpmainpaastacanary via `?canary=asdf` which returns `Set-Cookie: yelpmainpaastacanary=asdf; Domain=.yelp.com`.
2. Smuggle guvo inside it: `https://www.yelp.com/?canary=asdf%20guvo%3D%3C%2Fscript%3E%3Cscript%3Ealert(1)%3C%2Fscript%3E`.
3. Append `%3B%20Max%2DAge%3D99999999` to make the cookie persistent.
4. Visit www.yelp.com frontpage or biz.yelp.com/login; the unescaped guvo value breaks out of the script context and executes.
5. Deliver the crafted link to a victim; payload fires on next visit to Yelp.
**How found:** Researcher noticed the guvo cookie value reflected unescaped in window.ySitRepParams/window.yelp.guv, then discovered the canary query parameter sets yelpmainpaastacanary, and observed the backend splits cookies on spaces rather than semicolons, enabling smuggling guvo inside the settable cookie.
**Exploitation:** Attacker sends a crafted yelp.com link that sets a persistent smuggled guvo cookie containing a base64-encoded JS payload. On the victim's next visit to biz.yelp.com/login, the payload installs a keylogger exfiltrating email/password to attacker's domain, or on yelp.com/profile_sharing it fetches the CSRF token and POSTs a pre-generated Google id_token to /google_connect/register, linking the attacker's Google account to the victim's Yelp account for login via Sign in with Google.
**Escalation:** Chained cookie smuggling + persistent cookie (Max-Age) + XSS to achieve keylogging and full account takeover via Google account linking; link spreadable via forum, reviews, private messages.
**Insight:** When a cookie is reflected into inline JS, look for any attacker-settable cookie on the same domain and test whether the backend's cookie parser splits on spaces or other delimiters instead of semicolons, allowing one cookie to smuggle another.