# XSS in original referrer after follow

Twitter intent favorite-complete page reflected the original_referer parameter into a javascript: link, triggering XSS when the victim clicked 'return to previous site'.

- Payout: hidden
- Severity: medium
- Program: X / xAI
- Found by: akhil-reni
- Disclosed: 2015-03-09
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/50134
- Library page: https://bugbountylibrary.com/r/h1%3A50134
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium technique:param-pollution vuln:xss

**Target:** twitter.com/intent/favorite/complete endpoint
**Root cause:** The original_referer query parameter was reflected into the 'return to previous site' link without validating the scheme, allowing a javascript: URI.
**Steps:**
1. Open `https://twitter.com/intent/favorite/complete?tweet_id=572435913768366080&already_favorited=false&original_referer=javascript:alert%281%29;`
2. Click follow (must be a tweet from a user you don't follow)
3. Click 'return to previous site' to trigger the XSS
4. Deliver via `<a href="..." rel="noreferrer">` so the referrer is null
**How found:** Noticed the intent flow's 'return to previous site' link used the original_referer parameter and tested a javascript: scheme, discovering the null-referrer requirement to make it render.
**Exploitation:** Attacker hosts a page with an anchor to the crafted intent URL using rel=noreferrer to force a null referrer; victim clicks follow then 'return to previous site', executing javascript: in the twitter.com origin.
**Insight:** Intent/redirect-completion pages that build a 'return' link from a referer parameter are prime javascript:-scheme XSS spots; check whether a null referrer is required to reach the reflected sink.