# [app.simplenote.com] Stored XSS via Markdown SVG filter bypass

Markdown SVG animate payload bypassed Simplenote's sanitizer, storing JavaScript that executes in app.simplenote.com when a published note is viewed and clicked.

- Payout: hidden
- Severity: medium
- Program: Automattic
- Found by: ysx
- Disclosed: 2017-11-12
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/271007
- Library page: https://bugbountylibrary.com/r/h1%3A271007
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:react technique:parser-differential vuln:xss

**Target:** Markdown note editor/published note viewer on app.simplenote.com
**Root cause:** The Markdown input parser/sanitizer failed to strip an SVG <animate> element whose xlink:href is set to a javascript: URI, allowing script execution in the app origin.
**Steps:**
1. Log in to app.simplenote.com and create a new note with 'Markdown Formatted' enabled.
2. Paste the payload `<div id="137"><svg><a xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="?"><circle r="400"></circle><animate attributeName="xlink:href" begin="0" from="javascript:alert(document.domain)" to="&" /></a>//["'`-->]]>]</div>` into the Edit window.
3. Select the triple-dots icon > Publish.
4. Open the published Simplenote URL and click the black rectangle to trigger `javascript:alert(document.domain)`.
**How found:** Adapted a known DOMPurify SVG mXSS payload (animate xlink:href javascript:) and tested it against Simplenote's Markdown parser, confirming execution in Firefox 55.0.3.
**Exploitation:** Attacker publishes a note containing the crafted Markdown/SVG payload; any viewer of the published note who clicks the rendered rectangle executes attacker JavaScript in the app.simplenote.com origin.
**Insight:** SVG animation elements like <animate attributeName="xlink:href"> can smuggle javascript: URIs past sanitizers that only check static href attributes; try DOMPurify bypass corpus against Markdown renderers.