# Improperly validated fields allows injection of arbitrary HTML via spoofed React objects

Report triage reference field accepted arbitrary JSON objects; spoofing a React element with dangerouslySetInnerHTML injected arbitrary HTML/JS into other team members' report views.

- Payout: $5,000
- Severity: high
- Program: HackerOne
- Credited: danlec
- Disclosed: 2015-03-18
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/49652
- Library page: https://bugbountylibrary.com/r/h1%3A49652
- Tags: domain:web impact:integrity kind:bounty platform:hackerone sev:high tech:react technique:js-analysis technique:source-review vuln:xss

**Target:** Report triage reference field / trigger criterion data field (React rendering)
**Root cause:** Fields expected to be strings accept arbitrary JSON types and are passed directly as React children; a crafted object mimicking a React element (_isReactElement, type, props) is rendered as a real element with dangerouslySetInnerHTML.
**Steps:**
1. As attacker, POST to `https://hackerone.com/reports/bulk` with `reply_action: change-state`, `state: open`, `substate: triaged`, and `reference` set to a spoofed React element object
2. Set `reference` to `{_isReactElement:true,_store:{},type:"body",props:{dangerouslySetInnerHTML:{__html:"<h1>Arbitrary HTML</h1><script>alert(1)</script>"}}}`
3. As victim team member, open the report and observe injected HTML/script executes (no CSP)
**How found:** Noticed fields expected to be strings accepted arbitrary types (arrays/objects) and were returned from the server as non-strings; reasoned that these are passed as React children, which may be React element objects, and crafted a spoofed element.
**Exploitation:** Attacker with triage rights submits crafted JSON to the bulk reports endpoint setting reference to a fake React element; when any team member views the report, React renders the spoofed element and executes the injected HTML/JS in their session.
**Insight:** When a backend accepts arbitrary JSON types for fields rendered by React, test whether a spoofed React element object (_isReactElement, type, props.dangerouslySetInnerHTML) is trusted as a child — React's element check is structural, not authenticated.