# Bypass of #2035332 RXSS at image.hackerone.live via the `url` parameter

Reflected XSS in image.hackerone.live url parameter bypassed a HEAD-based Content-Type check via method-dependent responses, executing only in Safari.

- Payout: hidden
- Severity: low
- Program: HackerOne
- Found by: sudi
- Disclosed: 2023-08-22
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/2106708
- Library page: https://bugbountylibrary.com/r/h1%3A2106708
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:low tech:php technique:chained technique:incomplete-fix vuln:xss

**Target:** image.hackerone.live resource proxy `url` parameter
**Root cause:** The fix validated Content-Type via a HEAD request but fetched content via GET, so a server returning image/png on HEAD and a redirect on GET bypasses the check (TOCTOU). Sanitization also depended on the Accept header, which Safari sends as */*.
**Steps:**
1. Host `xss.php` that returns `Content-Type: image/png` on HEAD and `Location: https://sudistark.github.io/evilsvgfile.svg` on GET
2. Request `https://image.hackerone.live:8443/resource/md/get/url?url=http://yourhost/xss.php`
3. Open in Safari (sends `Accept: */*`, skipping sanitization) to trigger SVG XSS
**How found:** Noticed the patch used a HEAD request to validate Content-Type, hypothesized a server could return different responses per method, and observed Safari's `Accept: */*` header bypassed sanitization unlike other browsers.
**Exploitation:** Attacker-controlled URL passes the HEAD Content-Type image check, then GET returns a redirect to an attacker SVG that executes script in the image.hackerone.live origin in Safari.
**Insight:** When a fix validates a remote resource with HEAD but fetches with GET, serve divergent responses per method; also test whether sanitization branches on the Accept header, since Safari sends `*/*`.