# APIs for channels allow HTML entities that may cause XSS issue

Vimeo channel API stored unescaped HTML in channel name, executing stored XSS on album-create and channel-settings pages.

- Payout: hidden
- Severity: medium
- Program: Vimeo
- Found by: artem
- Disclosed: 2015-01-08
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/42702
- Library page: https://bugbountylibrary.com/r/h1%3A42702
- Tags: area:web domain:api domain:web impact:integrity kind:bounty platform:hackerone sev:medium technique:source-review vuln:xss

**Target:** Vimeo channels API and album/channel settings web pages
**Root cause:** The channels API accepts HTML/JS in the name and description fields without sanitization, and certain pages (album create, channel settings videos) render channel names into a select box without HTML-encoding.
**Steps:**
1. PATCH `https://api.vimeo.com/channels/855545` with `Authorization: Bearer [token]` and body `name=my channel<script>alert(document.cookie)</script>&description=bug bounty&privacy=anybody`
2. Confirm the channel page https://vimeo.com/channels/855545 does not execute (encoded)
3. Have victim subscribe to or moderate the malicious channel
4. Lure victim to https://vimeo.com/album/create or https://vimeo.com/channels/<channel_id>/settings/videos where the channel name is rendered unencoded in the select box
5. Script executes in victim's session
**How found:** Researcher tested the channels API and noticed HTML/JS was accepted in name/description; then compared pages and found most encode entities but album/create and channel settings/videos do not when building the select box.
**Exploitation:** Attacker injects JS into a channel name via the API, then must get the victim to subscribe to/moderate that channel and visit the album-create or channel-settings page, where the unencoded name in the select box executes.
**Insight:** When an API accepts rich text, hunt for secondary UI surfaces (select boxes, dropdowns, autocomplete widgets) that render that stored value without the encoding applied on the primary display page.