# XSS when using captions/subtitles on video player based on Flash (requires user interaction)

Vimeo's Flash-based Hubnut player rendered uploaded VTT captions without escaping, letting an attacker store HTML/JS that executed as XSS when a viewer enabled captions.

- Payout: hidden
- Severity: medium
- Program: Vimeo
- Found by: stefanovettorazzi
- Disclosed: 2017-08-31
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/88508
- Library page: https://bugbountylibrary.com/r/h1%3A88508
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium technique:source-review vuln:xss

**Target:** Flash-based video player (player.vimeo.com/hubnut) caption/subtitle rendering
**Root cause:** Uploaded .vtt caption files were stored and rendered by the Flash player without HTML escaping, so markup in the caption text was interpreted rather than displayed literally.
**Steps:**
1. Upload a video (or make all others private) on a fresh account.
2. Open video Settings > Advanced.
3. Upload a crafted `English.vtt` containing HTML/JS via 'Add Captions & Subtitles'.
4. Toggle Status to ON, set Language=English, Type=Captions, Save Changes.
5. As another user, visit `https://player.vimeo.com/hubnut/user/[user_url]` to force the Flash player.
6. Click Play, then CC > English to activate captions.
7. `alert(document.domain)` executes.
**How found:** Noticed the Flash player (reachable via the Hubnut widget, since Chrome defaults to HTML5) rendered caption text without escaping, and tested by uploading a VTT file containing HTML.
**Exploitation:** Attacker uploads a malicious VTT caption file to their own video, then lures a victim to the Hubnut widget URL (which forces the Flash player). When the victim enables the English captions, the injected markup executes in the player.vimeo.com origin, requiring the victim to click Play and select the caption track.
**Insight:** Legacy Flash/alternate player front-ends often lag behind the hardened HTML5 player's output encoding; when a widget forces an older player, retest user-supplied tracks (captions, subtitles, thumbnails) for missing escaping.