# XSS on https://www.starbucks.co.uk (can lead to credit card theft) (/shop/paymentmethod)

Reflected attribute injection in canonical link tag on Starbucks UK, chained with checkout click handler to execute JS and phish credit card data.

- Payout: hidden
- Severity: high
- Program: Starbucks
- Found by: bayotop
- Disclosed: 2018-05-22
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/227486
- Library page: https://bugbountylibrary.com/r/h1%3A227486
- Tags: area:web domain:web impact:ato impact:pii-leak kind:bounty platform:hackerone sev:high technique:chained technique:source-review vuln:csrf vuln:xss

**Target:** www.starbucks.co.uk shop pages (canonical link reflection, paymentmethod checkout)
**Root cause:** Full URL is reflected unencoded into the canonical link tag's href, allowing attribute injection; a site-wide script binds #checkout click to trigger #checkoutButton, turning injected attributes into JS execution.
**Steps:**
1. Log in at https://www.starbucks.co.uk/account/signin
2. Add any card to basket at https://www.starbucks.co.uk/shop/card/egift
3. Visit `https://www.starbucks.co.uk/shop/paymentmethod?==%u0022a%20onclick=confirm(/-/g+this.ownerDocument.domain)%20id=%u0022checkoutButton`
4. After load, click the 'Checkout' title (body element)
5. Prompt shows current domain, confirming JS execution
**How found:** Noticed full URL reflected in canonical link tag; probed WAF bypasses with %u0022 and == to inject attributes; read site JS and found #checkout click triggers #checkoutButton, then searched for a page with id=checkout (paymentmethod, body).
**Exploitation:** Attacker page auto-adds item to basket (no CSRF on Add to Basket), then navigates victim to crafted paymentmethod URL injecting onclick+id=checkoutButton into canonical link; clicking checkout triggers injected JS. Attacker can replace payment iframe src with phishing page to steal card data.
**Escalation:** Chained reflected attribute injection with existing checkout click handler and missing CSRF on Add to Basket to make exploit fully automatable from attacker-controlled page.
**Insight:** When URL reflection only yields attribute injection, grep site JS for jQuery selectors like $('#x').trigger('click') — injecting id matching the triggered element converts attribute injection into XSS. Also use ==%u0022 to dodge decodeURIComponent exceptions and WAF %22 blocks.