# Stored XSS in comments on https://www.starbucks.co.uk/blog/*

Stored XSS in the author field of Starbucks UK blog comments; WAF bypassed with onbeforescriptexecute handler to execute script in Firefox.

- Payout: hidden
- Severity: high
- Program: Starbucks
- Found by: bayotop
- Disclosed: 2017-06-27
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/218226
- Library page: https://bugbountylibrary.com/r/h1%3A218226
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:high tech:firefox technique:source-review vuln:xss

**Target:** Blog comment endpoint /blog/addcomment on www.starbucks.co.uk
**Root cause:** The `author` POST parameter is rendered into the comment HTML without encoding, allowing arbitrary HTML/attribute injection. A WAF blocks `<script>` and common `on*=` handlers but misses less-common event handlers.
**Steps:**
1. Identify blog posts via dork `site:www.starbucks.co.uk inurl:blog/` and locate the comment form.
2. Submit a comment via `POST /blog/addcomment` with body `Body=Nice&ParentId=0&PostID=1241&author=ope67164%40disaq.com`.
3. Inject payload in `author`: `</li></ul></li></ul></div></div></div></div><test/onbeforescriptexecute=confirm`h1poc`>` to break out of markup and attach an event handler.
4. Load the blog page in Firefox; the handler fires and executes `confirm`.
**How found:** Noticed the comment form reflects `author` into the page, tested HTML injection, hit the WAF on `<script>` and common `on*=` handlers, then enumerated less-common event handlers (e.g. `onbeforescriptexecute`) to bypass the blacklist.
**Exploitation:** Attacker posts a comment with a crafted `author` value; any visitor loading the blog post executes attacker JavaScript in the starbucks.co.uk origin, enabling session theft or page defacement.
**Insight:** When a WAF blacklists common `on*=` handlers, enumerate obscure/legacy event handlers like `onbeforescriptexecute`, `onwebkitanimationstart`, `ontransitionend` that still fire in some browsers; also break out of surrounding markup with closing tags so the injected element parses correctly.