# Stored XSS on support.rockstargames.com

Stored XSS via thread Title on Rockstar support forum; payload executed when another user typed a similar title and the suggestion engine rendered it.

- Payout: $1,000
- Severity: medium
- Program: Rockstar Games
- Credited: 0x0luke
- Disclosed: 2017-10-10
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/265384
- Library page: https://bugbountylibrary.com/r/h1%3A265384
- Tags: domain:web impact:integrity kind:bounty platform:hackerone sev:medium technique:second-order vuln:xss

**Target:** support.rockstargames.com Support Community thread title / title-suggestion feature
**Root cause:** Thread titles are stored and later re-rendered unescaped inside the similar-title suggestion UI, so a malicious title executes when suggested to another user.
**Steps:**
1. Create a new Support Community thread with an XSS payload in the Title field.
2. Wait for the title to be stored and indexed for title suggestions.
3. As a victim, start creating a new thread with a similar title.
4. The suggestion engine returns the malicious stored title and the script executes in the victim's browser.
**Exploitation:** Attacker plants a payload in a thread title; when any user begins composing a thread with a similar title, the suggestion widget renders the stored title and executes the script in their session.
**Insight:** Second-order stored XSS can hide in autocomplete/suggestion features that re-render previously stored user input long after submission; test title/name fields by triggering the suggestion UI from a different account.