# DOM Based XSS in www.hackerone.com via PostMessage

Marketo form's postMessage listener lacked origin check and validated followUpUrl, letting attacker send crafted mktoResponse to redirect victim to javascript: URI on hackerone.com.

- Payout: $500
- Severity: low
- Program: HackerOne
- Credited: adac95
- Disclosed: 2019-02-21
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/398054
- Library page: https://bugbountylibrary.com/r/h1%3A398054
- Tags: domain:web impact:ato impact:integrity kind:bounty platform:hackerone sev:low technique:source-review vuln:open-redirect vuln:xss

**Target:** www.hackerone.com contact form postMessage handler
**Root cause:** The window 'message' listener did not verify event.origin, and the success handler passed attacker-controlled followUpUrl directly to location.href without validating scheme, allowing javascript: URIs.
**Steps:**
1. Load https://www.hackerone.com/contact (Marketo form embedded in iframe).
2. From attacker page, open hackerone.com window and poll with `setInterval` sending `{"mktoResponse":{"for":"mktoFormMessage0","error":false,"data":{"formId":"1013","followUpUrl":"javascript:alert(document.domain);//","aliId":17144124}}}` every 250ms.
3. Victim submits the contact form so `inflight[requestId]` is populated with success/error callbacks.
4. Attacker message is processed by onResponse -> success -> location.href = followUpUrl, executing JS (blocked by CSP in modern browsers; works in CSP-less browsers).
5. Phishing variant: set followUpUrl to `https://attacker.sometld/401.php` returning `WWW-Authenticate: Basic` to spoof a HackerOne login prompt.
**How found:** Read the unminified Marketo forms2.js, noticed the message listener parsed JSON without checking event.origin, then traced onResponse -> success -> findCorrectFollowUpUrl -> location.href and hypothesized followUpUrl could be an absolute javascript: URL.
**Exploitation:** Attacker hosts a page that opens the HackerOne contact page and floods it with crafted postMessage payloads via setInterval; once the victim submits the form, the attacker's message races the legitimate Marketo response and triggers the success callback, redirecting to a javascript: URI (CSP-blocked in modern browsers) or to an attacker-controlled 401 page for phishing.
**Insight:** When auditing postMessage handlers, trace the full data flow from parsed message into sinks like location.href; even if the legitimate sender never sets a field, an attacker can supply it. Also check whether the handler requires prior state (inflight entry) that a victim action can populate.