# WAF bypass via double encoded non standard ASCII chars permitted a reflected XSS on response page not found pages - (629745 bypass)

Incomplete WAF fix on Starbucks 404 pages: injecting non-standard ASCII bytes (%80-%FF) between double-encoded quote and space bypasses the filter, restoring reflected XSS.

- Payout: hidden
- Severity: low
- Program: Starbucks
- Found by: laszaro
- Disclosed: 2020-01-29
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/716761
- Library page: https://bugbountylibrary.com/r/h1%3A716761
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:low tech:firefox technique:incomplete-fix technique:parser-differential vuln:misconfiguration vuln:xss

**Target:** www.starbucks.co.uk / www.starbucks.com.br 404 error pages (hidden input reflection)
**Root cause:** The original fix filtered double-encoded double-quote (%2522) followed by space (%2520), but the WAF only handled hex values %00-%7F; bytes %80-%FF inserted between them break the filter while the browser still parses the quote and space, allowing attribute injection into a hidden input tag.
**Steps:**
1. Visit `https://www.starbucks.com.br/testing%2522%80%2520accesskey='x'%2520onclick='confirm%601%60'` in Firefox 69.0.3
2. Press CONTROL+ALT+X (Mac) or ALT+SHIFT+X (Windows) to trigger the injected accesskey/onclick
3. Observe JavaScript execution (confirm dialog) proving reflected XSS
**How found:** After reading report 629745, the researcher probed the WAF filter itself, testing whether the double-encoded quote/space sequence could be interrupted. Inserting bytes and observing that %00-%7F were filtered (custom error/404/redirect pages) while %80-%FF passed through revealed the filter's byte-range gap.
**Exploitation:** Attacker crafts a URL whose 404 page reflects the path into a hidden input; injecting `%2522%80%2520accesskey='x'%2520onclick='confirm%601%60'` breaks out of the attribute and adds an accesskey-triggered onclick handler. Victim must load the URL and press the accesskey combo, yielding JS execution in Starbucks origin for info theft or actions on victim's behalf.
**Insight:** When a fix filters a specific encoded sequence, try inserting bytes between the tokens: WAFs often only normalize/filter ASCII (%00-%7F), so high bytes (%80-%FF) can act as separators that the browser ignores but the filter doesn't account for. Also test placing the high byte before the double-encoded token.