# Persistent XSS in https://sandbox.reverb.com/item/

Stored XSS via unencoded SoundCloud link field on Reverb listing pages, bypassing client-side-only validation by tampering the save request.

- Payout: hidden
- Severity: high
- Program: Reverb.com
- Found by: bigshaq
- Disclosed: 2018-05-06
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/333008
- Library page: https://bugbountylibrary.com/r/h1%3A333008
- Tags: area:web domain:web impact:ato impact:integrity kind:bounty platform:hackerone sev:high technique:source-review vuln:xss

**Target:** Listing edit/save endpoint (product[soundcloud_link_attributes][link]) on sandbox.reverb.com
**Root cause:** The SoundCloud link parameter is stored and rendered without output encoding; only client-side validation exists, so server accepts arbitrary values.
**Steps:**
1. Enter a valid SoundCloud link in Edit Listing to pass client-side validation.
2. Intercept the 'Save & Review Listing' request.
3. Replace product[soundcloud_link_attributes][link] with `https://soundcloud.com/rich-the-kid/sets/the-world-is-yours-15?fuzzing" onload=alert(document.domain) x="`.
4. Forward request; payload stored and executes on the listing page.
**How found:** Noticed the SoundCloud link field had only client-side validation; hypothesized server-side acceptance of arbitrary input and tested by tampering the save request.
**Exploitation:** Attacker stores the payload on their own listing; any victim visiting the listing page triggers the injected onload handler, executing JS in the Reverb origin.
**Escalation:** Chained with a self-XSS report (331725) to deny access to shop owners and perform actions on behalf of victims.
**Insight:** Fields validated only in the browser (URL/link inputs) are prime stored-XSS candidates: submit a valid value, then tamper the request to inject a quote-breaking payload into the stored attribute.