# Persistent cross-site scripting (XSS) in map attribution

Mapbox Studio allowed HTML/JS in the map attribution field, which was rendered unsanitized in Mapbox.js, giving persistent XSS and full session control via a shared project URL.

- Payout: $1,000
- Severity: high
- Program: Mapbox
- Credited: ph3t
- Disclosed: 2016-03-30
- CVE: CVE-2017-1000042
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/54327
- Library page: https://bugbountylibrary.com/r/h1%3A54327
- Tags: domain:web impact:ato impact:integrity kind:bounty platform:hackerone sev:high tech:rest technique:source-review vuln:xss

**Target:** Mapbox Studio Classic style attribution field rendered by Mapbox.js attribution control
**Root cause:** The attribution control intentionally supports HTML but did not sanitize user-provided attribution values from custom styles/TileJSON, so injected markup executed in the map page context.
**Steps:**
1. Open Mapbox Studio Classic, create a style with a name/description.
2. In the Attribution field inject `"><img src=x onerror=alert(document.cookie)>`.
3. Save, upload the project, close Studio.
4. Log into mapbox.com, go to Styles, select the style, click 'New project' (payload executes).
5. Save project settings, open the project list, share the project URL.
6. Any visitor (even unauthenticated) loading the shared project page executes the payload; PoC at api.tiles.mapbox.com/v4/pr0ph3t.lkag551j/page.html?access_token=...#3/0.00/0.00
**How found:** Researcher noticed the attribution field accepts arbitrary HTML and is rendered by the map attribution control, then tested injecting an img onerror payload via a custom style.
**Exploitation:** Attacker uploads a malicious style with an XSS payload in attribution, creates and saves a project using it, then shares the project URL. Victims visiting the URL (including unauthenticated users) execute attacker JS in the mapbox.com origin, granting full control over their Mapbox session.
**Escalation:** Payload executes on mapbox.com origin for any visitor of the shared project URL, enabling session/cookie theft and account takeover; also affects third-party sites loading untrusted TileJSON.
**Insight:** Map attribution/TileJSON metadata fields that intentionally allow HTML are prime stored-XSS sinks; test style/legend/attribution metadata that flows from a desktop editor into a shared public map URL.