# Self XSS in Tag name pattern field /<username>/<reponame>/settings/tag_protection/new

HTML injection via unsanitized check_pattern error into innerHTML on GitHub tag protection settings, escalated to CSRF-token-backed account changes via CSP bypass and script gadgets.

- Payout: hidden
- Severity: medium
- Program: GitHub
- Found by (vendor credit): Johan Carlsson (https://twitter.com/joaxcar), Roshan Kudave (https://twitter.com/ROSHANKUDAVE3), Sudhanshu Rajbhar (https://twitter.com/sudhanshur705)
- Found by: sudi
- Disclosed: 2024-04-15
- CVE: CVE-2024-1084
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/2246576
- Library page: https://bugbountylibrary.com/r/h1%3A2246576
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:rest technique:chained vuln:csrf vuln:xss

**Target:** Tag protection settings UI / check_pattern endpoint
**Root cause:** Error response from check_pattern endpoint injected into DOM via innerHTML without sanitization, allowing HTML injection despite CSP.
**Steps:**
1. Navigate to /<username>/<reponame>/settings/tag_protection/new
2. Trigger check_pattern error containing HTML payload
3. Drag-and-drop payload into the tag name pattern textbox
4. Observe injected HTML rendered via innerHTML
5. Chain on-site script gadgets to bypass CSP and perform actions with created CSRF tokens
**How found:** Researcher noticed check_pattern error response reflected into DOM via innerHTML; CSP blocked script but joaxcar identified script gadgets enabling action execution.
**Exploitation:** Attacker hosts a malicious site requiring user interaction (drag-and-drop of payload into textbox); injected HTML plus on-site script gadgets bypass CSP, create CSRF tokens, and make account changes.
**Escalation:** Combined HTML injection with on-site script gadgets to defeat CSP and mint CSRF tokens for sensitive account actions.
**Insight:** When CSP blocks inline script after HTML injection, hunt for on-site script gadgets (existing JS that reads DOM/attributes) that can be repurposed to execute actions and mint CSRF tokens.