# Stored XSS | api.mapbox.com | IE 11 | Styles name

Stored XSS in Mapbox Styles names executed in IE11 because JSON responses lacked X-Content-Type-Options: nosniff, allowing script execution.

- Payout: hidden
- Severity: medium
- Program: Mapbox
- Found by: renekroka
- Disclosed: 2020-01-21
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/763812
- Library page: https://bugbountylibrary.com/r/h1%3A763812
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:rest technique:source-review vuln:xss

**Target:** api.mapbox.com Styles API JSON responses
**Root cause:** Styles API JSON responses omitted the X-Content-Type-Options: nosniff header, so IE11 MIME-sniffed attacker-controlled style names as HTML and executed stored script.
**Steps:**
1. Create a style with an XSS payload in its name via the Styles API.
2. Retrieve the style JSON from api.mapbox.com in Internet Explorer 11.
3. IE11 sniffs the JSON as HTML and executes the stored payload because nosniff is absent.
**How found:** Researcher noticed JSON responses from api.mapbox.com lacked X-Content-Type-Options: nosniff and tested IE11's MIME sniffing against stored style names.
**Exploitation:** Attacker stores a script payload in a style name; when a victim loads the Styles API JSON response in IE11, MIME sniffing renders it as HTML and executes the script in the api.mapbox.com origin.
**Insight:** When JSON endpoints reflect user-controlled strings and lack nosniff, legacy IE MIME-sniffs them as HTML; test stored fields in JSON APIs specifically in IE11.