# Query parameter reordering causes redirect page to render unsafe URL

Duplicate url params plus Cloudflare query-string sorting caused backend and React frontend to disagree on which url to render, yielding reflected XSS in IE.

- Payout: $1,500
- Severity: medium
- Program: HackerOne
- Credited: kenziy
- Disclosed: 2017-11-30
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/293689
- Library page: https://bugbountylibrary.com/r/h1%3A293689
- Tags: domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:cdn technique:parser-differential vuln:xss

**Target:** hackerone.com /redirect endpoint with signed url parameter
**Root cause:** Cloudflare 'Query String Sort' reordered duplicate url params so the backend validated the signature against the last (benign) url while React read the first (payload) url from the browser's query string, creating a parser/ordering mismatch.
**Steps:**
1. Request `https://hackerone.com/redirect?signature=<valid>&url=http%3A%2F%2Fbuglabs.me&url=JAVASCRIPT:alert%09(document.domain)`
2. Cloudflare sorts params so `url=JAVASCRIPT:...` comes first (J < h in ASCII)
3. Backend (unicorn) validates signature against the last url param (benign) and returns 200
4. React reads the first url param from the browser query string and renders the javascript: payload
5. Payload executes in IE11 where CSP is ignored
**How found:** Researcher noticed the redirect warning page and tried adding a second &url param; observed signature still validated, then substituted a javascript: URI to attempt XSS, which worked in IE.
**Exploitation:** Attacker crafts a signed redirect URL with a duplicate url parameter; Cloudflare reorders so the backend signature check passes on the benign value while the browser/React renders the javascript: URI, executing script in IE11 (CSP not enforced).
**Insight:** Duplicate-parameter handling can differ between the validating backend and the rendering frontend; when a CDN reorders query strings, the param the server signs may not be the param the client reads. Test duplicate params on signed/redirect endpoints and check CDN query-sort behavior.