# XSS on https://www.udemy.com/asset/export.html

Stored XSS via lecture file title in Udemy's asset export endpoint, which returns JSON as text/html, executing in the presentation player.

- Payout: hidden
- Severity: medium
- Program: Udemy
- Found by: adrianbelen
- Disclosed: 2015-10-08
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/62400
- Library page: https://bugbountylibrary.com/r/h1%3A62400
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium technique:source-review vuln:xss

**Target:** asset/export.html endpoint and presentation player SWF
**Root cause:** The file title parameter is stored unsanitized and later reflected into the export.html response, which is served with Content-Type text/html despite being JSON, so injected HTML/SVG tags render and execute.
**Steps:**
1. Create a course and open the curriculum tab at `/course-manage/edit-curriculum?courseId=ID`
2. Add a presentation lecture, upload a PDF via `/upload/`
3. Submit the asset with `POST /asset/add-submit/?type=Presentation` setting `title="><svg/onload=javascript:alert(2);>...`
4. Preview the lecture; the player SWF requests `/asset/export.html` which renders the payload
**How found:** Noticed export.html returns JSON but with Content-Type text/html, allowing HTML tags to render; traced the title parameter from add-submit into that response.
**Exploitation:** Attacker (instructor) stores an SVG onload payload in the lecture title; when any student or instructor previews the lecture, the Flash player fetches export.html and the payload executes in the victim's session on udemy.com.
**Insight:** When an endpoint returns JSON with text/html content type, any stored field reflected there becomes an XSS sink even if the UI never displays it directly—check content types of API responses consumed by Flash/JS players.