# HTML injection (with XSS possible) on the https://www.data.gov/issue/ using media_url attribute

Reflected XSS in data.gov /issue/ via unsanitized media_url parameter, bypassing Akamai Kona WAF with a brute tag onbeforescriptexecute handler to run confirm(document.domain).

- Payout: hidden
- Severity: medium
- Program: GSA Bounty
- Found by: sp1d3rs
- Disclosed: 2017-09-15
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/263226
- Library page: https://bugbountylibrary.com/r/h1%3A263226
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:cdn technique:recon vuln:xss

**Target:** web endpoint /issue/ media_url query parameter
**Root cause:** The media_url query parameter is reflected into HTML without sanitization, allowing attribute/quote breakout; the Akamai Kona WAF's XSS filters were bypassed using an obscure brute tag with an onbeforescriptexecute handler.
**Steps:**
1. Visit `https://www.data.gov/issue/?media_url=catalog.data.gov/dataset/consumer-complaint-database%22%3E%3Csvg%20height=%22100%22%20width=%22100%22%3E%20%3Ccircle%20cx=%2250%22%20cy=%2250%22%20r=%2240%22%20stroke%22black%22%20stroke-width=%223%22%20fill=%22red%22%20/%3E%20%3C/svg%3E` to confirm HTML injection
2. For XSS in Firefox, load `https://www.data.gov/issue/?media_url=catalog.data.gov/dataset/consumer-complaint-database%22%3E%3C/div%3E%3C/div%3E%3Cbrute%20onbeforescriptexecute=%27confirm(document.domain)%27%3E`
3. Observe the confirm dialog firing with document.domain
**How found:** Researcher manually explored a large list of URLs gathered from Google Search, noticed the media_url reflection, then spent ~6 hours iterating payloads against the Akamai Kona WAF using brutelogic's filter/WAF evasion tips until the brute tag with onbeforescriptexecute passed the filter.
**Exploitation:** Attacker crafts a URL with a quote-breakout payload in media_url; victim clicking the link executes attacker-controlled JS in the data.gov origin, enabling session/data theft. WAF bypass required the nonstandard brute tag and onbeforescriptexecute event.
**Insight:** When a WAF blocks common tags/events, try obscure/nonstandard HTML elements (e.g. brute) paired with legacy event handlers like onbeforescriptexecute that filters often omit; manual reflection hunting on parameter-rich endpoints beats scanners when a WAF is present.