# Cross-site Scripting (XSS) on HackerOne careers page

DOM XSS on HackerOne careers page via lever- URL parameter concatenated into jQuery HTML append, exploitable in IE/Edge where URL isn't encoded.

- Payout: $500
- Severity: low
- Program: HackerOne
- Credited: khoidv1
- Disclosed: 2019-02-17
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/474656
- Library page: https://bugbountylibrary.com/r/h1%3A474656
- Tags: domain:web impact:integrity kind:bounty platform:hackerone sev:low technique:js-analysis technique:source-review vuln:xss

**Target:** www.hackerone.com/careers DOM XSS via lever- query parameter
**Root cause:** The Masonry/jobs JS reads window.location.href, extracts everything after '?lever-' into leverParameter, and concatenates it into an href inside a jQuery .append() HTML string without sanitization.
**Steps:**
1. Visit https://www.hackerone.com/careers in IE or Edge (Chrome/Firefox URL-encode the payload)
2. Append payload: `?lever-#aaa"><script src="https://app-sj17.marketo.com/index.php/form/getForm?callback=alert"></script>`
3. The script splits on '?lever-', takes the remainder as leverParameter, and injects it into the job link href via jQuery append
4. Script tag executes (CSP blocks full exploitation)
**How found:** Researcher read the Masonry/jobs JS file, noticed window.location.href was split on '?lever-' and the remainder concatenated into an href inside a jQuery .append() HTML string, then tested a quote-breakout payload.
**Exploitation:** Attacker crafts a careers URL with a lever- parameter containing a closing quote and script tag; the page's job-listing JS concatenates it into an HTML string passed to jQuery .append(), causing DOM XSS in IE/Edge. CSP prevented full weaponization.
**Insight:** Third-party job-board integrations (Lever) that preserve tracking query params by string-splitting location.href and re-injecting into jQuery HTML strings are a recurring DOM XSS source; test in browsers that don't auto-encode URLs (IE/Edge) to bypass client-side normalization.