# Client-side Template Injection in Search, user email/token leak and maybe sandbox escape

AngularJS template injection in Rockstar support search field exposed the page scope, letting an attacker exfiltrate another user's email, userid and tokens via a manipulated avatar URI.

- Payout: hidden
- Severity: medium
- Program: Rockstar Games
- Found by: europa
- Disclosed: 2018-05-01
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/271960
- Library page: https://bugbountylibrary.com/r/h1%3A271960
- Tags: area:web domain:web impact:ato impact:data-leak kind:bounty platform:hackerone sev:medium technique:source-review vuln:info-disclosure vuln:xss

**Target:** support.rockstargames.com search field and avatar URI
**Root cause:** User input in the search field was compiled by AngularJS as a template expression, allowing access to the page's AngularJS scope. Avatar URI values were also rendered without ng-non-bindable protection.
**Steps:**
1. Inject an AngularJS expression into the search field to confirm template evaluation and reach the scope.
2. Traverse the DOM via `childHead`/`nextSibling` objects to read the active scope's email, userid and tokens.
3. Set the victim's avatar URL to an attacker-controlled resource so the leaked data is delivered via simple GET requests.
**How found:** Researcher recognized AngularJS template evaluation in the search field and explored the exposed scope, discovering DOM traversal via childHead/nextSibling could reach sensitive scope values.
**Exploitation:** Attacker injects an AngularJS expression in the search field, walks the scope via childHead/nextSibling to read email, userid and tokens, then points the victim's avatar URI at an attacker server to exfiltrate the data through GET requests without JavaScript injection.
**Escalation:** A sandbox escape was later found, making the DOM-traversal exfiltration approach unnecessary.
**Insight:** When AngularJS compiles user input, the whole scope is reachable; childHead/nextSibling traversal can pull secrets even without full JS execution, and a controllable outbound URL like an avatar URI turns that into exfiltration.