# Cross-Site Scripting (XSS) on www.starbucks.com | .co.uk login pages

Reflected XSS on Starbucks login pages via ASP.NET cookieless-session path segment reflected unescaped into a link, enabling credential theft.

- Payout: hidden
- Severity: high
- Program: Starbucks
- Found by: cdl
- Disclosed: 2020-06-30
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/881115
- Library page: https://bugbountylibrary.com/r/h1%3A881115
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:high tech:dotnet technique:source-review vuln:xss

**Target:** ASP.NET login page (www.starbucks.com/account/signin)
**Root cause:** ASP.NET cookieless-session URI segment (A(...)/F(...)) is reflected into page links without HTML escaping, letting an attacker break out of the tag and inject an event handler.
**Steps:**
1. Visit `https://www.starbucks.com/account/(A(%22%20%252fonmouseover=%22alert%25%32%38%64%6f%63%75%6d%65%6e%74.%64%6f%6d%61%69%6e%25%32%39%22))/signin`
2. Hover the 'Find the Store' button in the upper right
3. alert(document.domain) fires
4. For credential theft use the F(...) variant that reads `document.getElementsByName('Account.Password')[0].value`
**How found:** Noticed the login page builds links from the relative URL path, and that the ASP.NET cookieless-session segment (A(...)/F(...)) is attacker-controllable and reflected unescaped.
**Exploitation:** Attacker crafts a URL with a malicious cookieless-session path segment; victim hovers the injected link and JS executes in www.starbucks.com origin, allowing theft of the password field value from the login page.
**Insight:** ASP.NET cookieless session tokens embedded in the URL path (A(...)/F(...)) are a reflection source; test them for unescaped output in links on legacy .NET apps.