# CSRF leads to a stored self xss

CSRF creates an Imgur favorites folder whose name holds an XSS payload, firing when a victim adds an image to it.

- Payout: hidden
- Severity: low
- Program: Imgur
- Found by: hogarth45
- Disclosed: 2019-08-30
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/323005
- Library page: https://bugbountylibrary.com/r/h1%3A323005
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:low tech:rest vuln:csrf vuln:xss

**Target:** Imgur favorites folder API (api.imgur.com/3/folders) and folder-name rendering
**Root cause:** Folder names are stored and rendered without sanitization, and the folder-creation API accepts cross-site JSON POSTs without CSRF protection.
**Steps:**
1. Create a favorites folder named `"'><img src=x onerror=prompt(1)>` and save.
2. Visit a photo, click the plus next to the heart, add the image to that folder; the payload fires.
3. To deliver to a victim, host an auto-submitting form: `<form method='POST' enctype='application/json' action='https://api.imgur.com/3/folders'>` with `name` = `New Test"><img src=x onerror=prompt(2)>` and `is_private` = `false`.
4. Victim visits the page while logged in; the folder is created with the XSS name.
5. Victim later adds an image to that folder, triggering the stored XSS.
**How found:** Noticed that a folder name containing an XSS payload executes when saving an image to that folder; since self-XSS alone is out of scope, looked for a way to plant the folder on a victim and found the folders API lacked CSRF protection.
**Exploitation:** Attacker lures a logged-in Imgur user to a page that auto-submits a cross-site JSON POST to the folders API, planting a folder with an XSS payload as its name. The payload executes when the victim adds an image to that folder, enabling account hijacking; success depends on the victim performing that add action.
**Escalation:** Chains out-of-scope self-XSS with CSRF to convert it into a deliverable attack against other users.
**Insight:** When a self-XSS sink is out of scope, look for a state-changing API that writes attacker-controlled data into that sink and test whether it accepts cross-site form posts (especially JSON enctype forms) to weaponize it.