# XSS when clicking "Share to Twitter" at quora.com/widgets/embed_iframe?path=...

Question title with quotes breaks out of the Share-to-Twitter javascript: href in Quora's embed_iframe widget, executing XSS on click.

- Payout: hidden
- Severity: low
- Program: Quora
- Found by: stefanovettorazzi
- Disclosed: 2018-01-11
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/258876
- Library page: https://bugbountylibrary.com/r/h1%3A258876
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:low technique:source-review vuln:xss

**Target:** quora.com/widgets/embed_iframe endpoint rendering answer share widget
**Root cause:** The question title is interpolated unescaped into the href attribute of the Share to Twitter button, so a `"` in the title breaks out of the attribute and injects a javascript: payload.
**Steps:**
1. Ask a question titled `Question ignore "-alert(document.domain)-"?`
2. Answer it and copy the path, e.g. `/Question-ignore-alert-document-domain/answer/Cuenta-Para-Probar`
3. Visit `https://www.quora.com/widgets/embed_iframe?path={path}`
4. Click _Share_, then _Share to Twitter_
5. `alert(document.domain)` executes
**How found:** Noticed the Share to Twitter href is built as a javascript: window.open(...) string containing the question title, and hypothesized a quote in the title would break out of the attribute.
**Exploitation:** Victim must load the crafted embed_iframe URL and click Share then Share to Twitter; the injected javascript: href runs in quora.com origin.
**Insight:** Embed/share widgets that build javascript: hrefs from user-controlled titles are prime quote-breakout XSS targets; test titles containing `"` against any share/intent button.