# VK mobile: backslash escape bypass yields reflected XSS in photo viewer

VK mobile photo viewer passed location.hash into photo.fullscreen() inside a JS string; a backslash before a quote defeated escaping, enabling reflected XSS.

- Payout: hidden
- Severity: high
- Program: VK.com
- Found by: bo0om
- Disclosed: 2015-10-30
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/80298
- Library page: https://bugbountylibrary.com/r/h1%3A80298
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:high technique:source-review vuln:xss

**Target:** Mobile web photo viewer (m.vk.com/feed) onclick handler
**Root cause:** location-derived data is interpolated into a JS string in photo.fullscreen() with escaping that escapes single quotes but not backslashes, so a `\'` prefix turns into `\\'` and the quote escapes the string.
**Steps:**
1. Open `https://m.vk.com/feed?z=photo-25557243_375319886%2F#abc'123` and observe the quote is escaped in the generated `photo.fullscreen('...')` call.
2. Open `https://m.vk.com/feed?z=photo-25557243_375319886%2F#abc\'123` and observe the backslash survives, producing `\\'` and breaking out of the string.
3. Load `https://m.vk.com/feed?z=photo-25557243_375319886%2F#\')+alert(document.domain)//` and click the photo to trigger onclick and execute JS.
**How found:** Noticed location data flowed into photo.fullscreen() and that escaping covered single quotes but not backslashes; hypothesized a `\'` prefix would survive escaping and re-enable the quote, then tested the hash payloads.
**Exploitation:** Attacker crafts a URL whose hash breaks out of the string literal in the onclick-generated photo.fullscreen() call; victim clicks the photo and arbitrary JS runs in m.vk.com origin, allowing content substitution, reading messages, or actions as the user.
**Insight:** When a filter escapes quotes but not backslashes, prefix the quote with a backslash so the escape routine produces `\\'` and the quote terminates the string; test hash/URL-derived values interpolated into inline JS handlers.