# XSS on Issue reference numbers

GitLab's Bootstrap tooltip sanitizer allowed svg/use/xlink:href, so an issue title with an external SVG loaded via foreignObject executed JS on hover in Firefox.

- Payout: hidden
- Severity: medium
- Program: GitLab
- Found by: yvvdwf
- Disclosed: 2020-11-23
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/831962
- Library page: https://bugbountylibrary.com/r/h1%3A831962
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:medium tech:firefox technique:chained technique:source-review vuln:xss

**Target:** Issue reference tooltip (Bootstrap tooltip HTML sanitizer)
**Root cause:** GitLab's Bootstrap sanitizer whitelist permits <svg>, <use> and xlink:href, letting an attacker reference an external SVG whose foreignObject iframe srcdoc runs script; Firefox renders foreignObject, WebKit does not.
**Steps:**
1. Upload `alert.js` to a project and expose it via CI job artifacts so it is served as `application/javascript` (bypasses text/plain + nosniff).
2. Upload `xss.svg` containing `<foreignObject><iframe xmlns="http://www.w3.org/1999/xhtml" srcdoc='<script src=...alert.js></script>'></iframe></foreignObject>`.
3. Create an issue titled `<svg><use xlink:href="https://.../xss.svg#xss"/></svg>`.
4. Reference the issue (`#1`) in a discussion/wiki; hovering the reference renders the tooltip and executes the script in Firefox.
**How found:** Noticed GitLab's Bootstrap sanitizer whitelist includes svg/use/xlink:href; hypothesized external SVG resource loading could bypass sanitization, and tested Firefox-specific foreignObject rendering to achieve script execution.
**Exploitation:** Attacker plants a malicious issue title and a reference to it; when a victim hovers the reference number, the tooltip HTML renders the external SVG, whose foreignObject iframe loads the attacker's JS served as application/javascript from CI artifacts, executing in gitlab.com origin.
**Insight:** When a sanitizer whitelists SVG elements, check whether <use xlink:href> can pull an attacker-hosted SVG; Firefox renders foreignObject (WebKit doesn't), so browser-specific SVG features can turn a 'safe' whitelist into XSS. Also, CI job artifacts serve files as application/javascript, bypassing text/plain+nosniff on raw uploads.