# Dom based xss affecting all pages from https://www.grab.com/.

DOM XSS on all grab.com pages via a regex-based HTML stripper bypassed with malformed nested tags, executing confirm() through an img onerror handler.

- Payout: hidden
- Severity: medium
- Program: Grab
- Found by: netfuzzer
- Disclosed: 2017-08-17
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/247246
- Library page: https://bugbountylibrary.com/r/h1%3A247246
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium technique:incomplete-fix vuln:xss

**Target:** grab.com web pages, client-side stripHtml function
**Root cause:** stripHtml strips tags with a regex /<\/?\w+[^>]*\/?>/g then assigns to div.innerHTML; malformed nested tags like `<<a/:<"a">img src=# onerror=...>` survive the regex and are parsed by the browser into an executing img element.
**Steps:**
1. Locate stripHtml which does div.innerHTML = html.replace(/<\/?\w+[^>]*\/?>/g, "")
2. Craft payload that evades the tag regex but is parsed as HTML by innerHTML: `<<a/:<"a">img src=# onerror=confirm('XSSED')>`
3. Visit `https://www.grab.com/sg/partnerships/?xss=%3C%3Ca/%3A%3C%22a%22%3Eimg%20src%3D%23%20onerror%3Dconfirm%28%27XSSED%27%29%3E`
4. confirm('XSSED') fires, confirming DOM XSS
**How found:** Researcher noted a prior fix added a regex to stripHtml and tested malformed/nested tag syntax to bypass the regex while still being parsed by innerHTML.
**Exploitation:** Attacker crafts a URL with the xss query parameter containing the malformed tag payload; victim visiting the link triggers script execution in grab.com origin.
**Insight:** Regex tag-stripping before innerHTML is bypassable with malformed nested tags (`<<a/:<"a">img ...>`); when a filter was patched, retry with parser-confusing tag syntax rather than new event handlers.