# XSS at http://vk.com on IE using flash files

Flash file served as application/zip without nosniff was played by IE, letting a crafted SWF URL with onMouseOver param execute JS via document.write of the hash.

- Payout: $500
- Severity: medium
- Program: VK.com
- Credited: tunnelshade
- Disclosed: 2015-10-30
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/66121
- Library page: https://bugbountylibrary.com/r/h1%3A66121
- Tags: domain:web impact:integrity kind:bounty platform:hackerone sev:medium technique:recon technique:source-review vuln:xss

**Target:** Flash SWF files (photo_uploader_lite.swf, CaptureImg.swf) on vk.com
**Root cause:** SWF served with application/zip content type and no X-Content-Type-Options: nosniff, so IE sniffs and executes it as Flash; the SWF reflects URL parameters (onMouseOver) into an ActionScript sink that calls document.write on the location hash.
**Steps:**
1. Open in Internet Explorer: `http://vk.com/swf/photo_uploader_lite.swf?h=h?&onMouseOver=document.write(window.location.hash.substr(1))#<script>alert(document.domain)</script>`
2. Hover the mouse over the page to trigger onMouseOver
3. Observe alert(document.domain) executing in vk.com origin
**How found:** Researcher noticed SWF files served as application/zip without nosniff, realized IE would still sniff and play them, then found FlashVars-style parameters (onMouseOver) reflected into an ActionScript sink.
**Exploitation:** Attacker lures IE victim to the crafted SWF URL (optionally framed since no X-Frame-Options); hovering triggers the injected onMouseOver handler which document.writes the script from the URL hash, executing JS in vk.com origin.
**Insight:** When a server serves SWF/active content with a wrong MIME type, check whether IE's content sniffing still executes it; FlashVars-style query params like onMouseOver/onLoad are ActionScript sinks worth fuzzing on any legacy .swf endpoint.