# Markdown parsing issue enables insertion of malicious tags

Phabricator's URL markdown parser let nested link syntax inject arbitrary attributes into anchor tags, enabling defacement, tab nabbing, and XSS on CSP-less browsers.

- Payout: hidden
- Severity: medium
- Program: Phabricator
- Found by: sectex
- Disclosed: 2019-12-13
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/758002
- Library page: https://bugbountylibrary.com/r/h1%3A758002
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:php technique:parser-differential vuln:crlf-injection vuln:xss

**Target:** Markdown comment renderer / URL link syntax
**Root cause:** The URL markdown parser recursively re-parses bracketed content inside a link destination, so nested `[[/attr=value .]]` syntax leaks attacker-controlled attributes into the generated anchor element.
**Steps:**
1. Post a comment containing `[ ](https://a.de?p=[[/data-x=. style=background-color:#000000;z-index:999;width:100%;position:fixed;top:0;left:0;right:0;bottom:0; data-y=.]])` to overlay the page (deface).
2. Post `[ ](https://sectex.dev/files/tabnabbing.html?[[/target=_blank `.`]])` so clicking opens a new window that rewrites the parent location (tab nabbing).
3. Post `[ ](http://a?p=[[/onclick=alert(0) .]])` and click the link to trigger XSS on browsers without CSP (IE 11, Safari 5.1.7).
**How found:** Researcher experimented with nested bracket syntax inside markdown link destinations and observed that inner `[[/attr=value .]]` tokens were parsed as anchor attributes rather than URL text.
**Exploitation:** Any authenticated user posts a crafted markdown comment; when other users view the task/commit, the injected anchor attributes render, enabling page overlay defacement, tab nabbing via target=_blank, or onclick XSS where CSP is unsupported.
**Escalation:** Chained attribute injection into multiple vectors (style overlay, target=_blank tab nabbing, onclick handler) from a single parser flaw.
**Insight:** When a markdown link destination is itself re-parsed for markup, try nesting the parser's own attribute syntax (`[[/attr=value .]]`) inside the URL to smuggle attributes into the rendered anchor; test target/rel and event handlers even when CSP blocks inline JS.