# Reflected XSS

Unsanitized HTML comment preview on Ubiquiti's Spanish/Portuguese forums allowed reflected XSS via GET params, escalatable to stored XSS by saving a draft.

- Payout: hidden
- Severity: high
- Program: Ubiquiti Inc.
- Found by: aidantwoods
- Disclosed: 2018-09-25
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/304175
- Library page: https://bugbountylibrary.com/r/h1%3A304175
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:high technique:chained vuln:xss

**Target:** Forum 'New Discussion' comment preview feature
**Root cause:** The comment area renders user HTML in the preview before sanitization, so crafted input executes script in the page context.
**Steps:**
1. Navigate to the 'New Discussion' page on the Spanish or Portuguese Ubiquiti forum.
2. Supply a crafted HTML/script payload via GET variables into the comment area.
3. Trigger the 'preview' function so the unsanitized comment is rendered, executing the XSS.
4. Optionally save the payload as a draft to convert it into a stored XSS.
**How found:** Researcher noticed the comment preview rendered HTML prior to sanitization, and that the post itself did not yield XSS but the pre-post preview did.
**Exploitation:** Attacker links a logged-in user to a crafted forum URL (or abuses a validated redirect on *.ubnt.com) so the preview renders the payload; saving as draft yields stored XSS.
**Escalation:** Reflected XSS escalated to stored XSS by saving the payload as a draft, and delivery widened via domain-trust redirects.
**Insight:** Preview/render-before-save paths often skip the sanitizer applied on final submission; test draft and preview states separately from published content.