# XSS on vimeo.com | "Search within these results" feature (requires user interaction)

Unescaped search query reflected into data-start-page attribute on Vimeo search pages enables attribute-injection XSS via crafted video title, executing JS on hover.

- Payout: hidden
- Severity: medium
- Program: Vimeo
- Found by: stefanovettorazzi
- Disclosed: 2017-08-31
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/88105
- Library page: https://bugbountylibrary.com/r/h1%3A88105
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium technique:source-review vuln:xss

**Target:** vimeo.com user/category video search results page
**Root cause:** The search query (URL path) is written into the data-start-page attribute of an <li> element without HTML-escaping, allowing an attacker to break out of the attribute and inject an event handler.
**Steps:**
1. Upload a video or open Settings of an existing one.
2. Set the video Title to `"onmouseover="alert(document.domain)/` and save.
3. As another user, visit `https://vimeo.com/[user]/videos/search:%22onmouseover%3D%22alert%28document.domain%29%26%23x2f%3B/`.
4. Hover over the uploaded video's thumbnail in the results.
5. `alert(document.domain)` executes (Firefox only; Chrome XSS Auditor blocks).
**How found:** Noticed that searching on category/user video pages reflects the URL path into a data-start-page attribute; hypothesized attribute injection by crafting a title matching the search query, and worked around the %2F 404 by encoding the slash as `/`.
**Exploitation:** Attacker controls a video title containing an attribute-breakout payload; victim visits a crafted search URL whose query matches the title, causing the unescaped query to be reflected into data-start-page and the injected onmouseover handler to fire on hover. Requires user interaction (mouseover) and Firefox.
**Insight:** When a search query is reflected into an HTML attribute (not element body), test attribute-breakout payloads via a stored field (like a video title) that the query matches; encode `/` as `/` to bypass routing 404s on path-based search.