# Reflected XSS on https://www.zomato.com

Reflected XSS in Zomato's googleOAuth2Callback via unescaped backslash in the state parameter reflected into a script context, executing JS for authenticated users.

- Payout: hidden
- Severity: medium
- Program: Eternal
- Found by: strukt
- Disclosed: 2018-04-07
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/311639
- Library page: https://bugbountylibrary.com/r/h1%3A311639
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:medium tech:oauth technique:source-review vuln:xss

**Target:** googleOAuth2Callback endpoint on www.zomato.com
**Root cause:** The state parameter value is reflected into a <script> context without properly escaping the backslash character, allowing the attacker to escape the string quote and inject JS.
**Steps:**
1. Craft URL `https://www.zomato.com/googleOAuth2Callback?)}(alert)(location);{%3C!--&state=\`
2. Open the URL as an authenticated user
3. The trailing backslash escapes the closing quote in the script context, breaking out and executing the injected `(alert)(location)` payload
**How found:** Observed that the state parameter's backslash was not escaped when reflected into a script context, then used it to escape the surrounding quote and inject JS.
**Exploitation:** Attacker lures an authenticated Zomato user to the crafted URL; the reflected payload executes in the page origin, enabling theft of user information or redirection to malicious sites.
**Insight:** When a parameter is reflected inside a <script> block, a lone trailing backslash can escape the closing quote even if quotes are encoded; test backslash-terminated values in JS string contexts.