# Stored XSS in learnboost.com via the lesson[goals] parameter.

Stored XSS in learnboost.com's lesson[goals] field via a javascript: form action, letting an attacker exfiltrate a victim's dashboard HTML on click.

- Payout: hidden
- Severity: medium
- Program: Automattic
- Found by: edoverflow
- Disclosed: 2018-04-22
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/300270
- Library page: https://bugbountylibrary.com/r/h1%3A300270
- Tags: area:web domain:web impact:ato impact:data-leak kind:bounty platform:hackerone sev:medium technique:source-review vuln:xss

**Target:** Lesson editor /apps/lesson/update endpoint (lesson[goals] parameter)
**Root cause:** The lesson[goals] field is stored and rendered without sanitization, allowing a form with a javascript: action attribute to execute script when the victim clicks the button.
**Steps:**
1. Send `POST /apps/lesson/update` with `lesson%5Bgoals%5D=%3Cform%20action%3D%22javasc%0Aript%3Aalert(document.domain)%22%3E%3Cbutton%3EClick%3C%2Fbutton%3E%3C%2Fform%3E` and valid CSRF/session headers
2. Visit the stored lesson page at `/lesson/<id>/untitled`
3. Click the injected button to trigger the javascript: action
**Exploitation:** Attacker stores a form with a javascript: action in lesson[goals]; when a victim views the lesson page and clicks the button, script runs in the learnboost.com origin and can exfiltrate data (demonstrated by sending the first 700 chars of the victim's dashboard HTML to an attacker server).
**Insight:** The newline inside `javasc\nript:` bypasses naive scheme filters while browsers still parse it as javascript:; test form action attributes, not just script tags, when probing stored fields.