# Stored XSS / Bypassing .htaccess protection in http://nodebb.ubnt.com/

NodeBB instance on unprotected port 4567 allowed uploads with unsanitized filenames and EXIF data, enabling stored XSS via .html file.

- Payout: hidden
- Severity: high
- Program: Ubiquiti Inc.
- Found by: inhibitor181
- Disclosed: 2017-09-28
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/202354
- Library page: https://bugbountylibrary.com/r/h1%3A202354
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:high tech:nodejs technique:recon vuln:file-upload vuln:misconfiguration vuln:xss

**Target:** NodeBB forum upload API on port 4567
**Root cause:** Upload API does not sanitize filenames or EXIF metadata and sets incorrect MIME types, allowing HTML/JS content to be served as .html.
**Steps:**
1. Run `sudo nmap -sSV -p- 104.131.159.88 -oA stage_ph -T4` and find `4567/tcp open tram?`
2. Access `http://nodebb.ubnt.com:4567/` which is unprotected
3. Create account and use upload API to upload an image with malicious HTML injected in EXIF data
4. Rename/change file extension to `.html`
5. Access uploaded file to trigger stored XSS
**How found:** Researcher noticed nodebb.ubnt.com was htaccess-protected, ran nmap, and found port 4567 exposed with the same NodeBB instance unprotected.
**Exploitation:** Attacker uploads a file with HTML/JS payload in EXIF data and .html extension; the server serves it with a MIME type that causes the browser to render and execute the script, achieving stored XSS against forum users.
**Escalation:** Noted that uploading .php with PHP content via EXIF is possible, though RCE was not achieved.
**Insight:** When a protected subdomain exists, scan the underlying IP for alternate open ports serving the same app without the protection layer; upload endpoints that trust filenames/EXIF can yield stored XSS.