# Self-Stored XSS - Chained with login/logout CSRF

Stored XSS in with_tags_data review field, chained with login/logout CSRF, let an attacker steal a victim's Facebook OAuth tokens and take over their Zomato account in one click.

- Payout: $300
- Severity: medium
- Program: Eternal
- Credited: madguyyy
- Disclosed: 2019-07-03
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/632017
- Library page: https://bugbountylibrary.com/r/h1%3A632017
- Tags: domain:web impact:ato kind:bounty platform:hackerone sev:medium tech:oauth technique:chained technique:source-review vuln:account-takeover vuln:csrf vuln:xss

**Target:** Zomato review submission endpoint /php/submitReview (with_tags_data parameter) and /php/asyncLogin.php
**Root cause:** The with_tags_data review parameter is stored and later rendered unescaped when the review edit page loads, executing attacker JavaScript; additionally logout and asyncLogin endpoints lack CSRF protection.
**Steps:**
1. POST to `https://www.zomato.com/php/submitReview` with `with_tags_data=<script>prompt(0,document.domain)</script>` and valid csrf_token/res_id.
2. Load the review and click Edit; the payload executes (prompt fires).
3. Replace payload with script that loads FB JS SDK, calls `FB.login` and POSTs `FB.getAuthResponse()` to attacker server, then redirects to `/logout`.
4. Craft HTML page: `<img src="https://www.zomato.com/logout">` to force logout, then auto-submit a form POST to `https://www.zomato.com/php/asyncLogin.php?access_token=...` with attacker's authResponse fields to log victim into attacker account.
5. Redirect victim to the XSS review page; when victim clicks Edit, tokens are exfiltrated to attacker.
**How found:** Researcher noticed the with_tags_data parameter accepted raw HTML/JS and was rendered on the edit-review page; then observed logout and asyncLogin endpoints accepted cross-site requests without CSRF tokens, enabling session swap before triggering the payload.
**Exploitation:** Victim visits attacker page: forced logout via CSRF, forced login into attacker's account via asyncLogin CSRF, redirect to attacker's XSS review. Victim clicks Edit, XSS runs, FB.login returns victim's Facebook accessToken/signedRequest which is POSTed to attacker's tokens.php. Attacker uses tokens to log into victim's account.
**Escalation:** Chained stored XSS + WAF bypass + login CSRF + logout CSRF to convert a self-XSS into a one-click account takeover via OAuth token theft.
**Insight:** Self-XSS becomes exploitable when combined with login CSRF: force the victim into the attacker's session, then have them trigger the stored payload on their own account context to harvest OAuth tokens tied to the victim's identity.