# Reflected Flash XSS using swfupload.swf with an epileptic reloading to bypass the button-event

Reflected Flash XSS in Imgur's swfupload.swf via buttonText HTML injection, bypassing button-event override by rapid iframe reloads.

- Payout: hidden
- Severity: medium
- Program: Imgur
- Found by: fransrosen
- Disclosed: 2016-07-28
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/91421
- Library page: https://bugbountylibrary.com/r/h1%3A91421
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium technique:race-window vuln:xss

**Target:** swfupload.swf Flash file on imgur.com
**Root cause:** swfupload.swf reflects the buttonText parameter into HTML rendered inside the Flash button, allowing injection of an anchor with a javascript: href. The buttonAction parameter normally overrides the MouseClick event, but rapid reloads create a race window where the injected HTML click handler fires first.
**Steps:**
1. Load `https://imgur.com/include/flash/swfupload.swf?buttonDisabled=&buttonText=%3Ca%20%20href=%22javascript:alert(document.domain)%22%3ECLICKME...%3C/a%3E&buttonImageURL=/&buttonTextStyle=a{color:%23ff00ff}&buttonAction=-120&buttonCursor=-2`
2. Embed the SWF in an iframe and reload it every 300ms via `setInterval` so the SWF is served from cache
3. Click the injected CLICKME text during the brief window before buttonAction overrides the MouseClick event
4. javascript: href executes in imgur.com origin, triggering alert(document.domain)
**How found:** Noticed Imgur hosts swfupload.swf on the main domain and that buttonText accepts HTML. Observed buttonAction overrides the MouseClick event, then hypothesized a race window by rapidly reloading the SWF from cache to catch the click before the override.
**Exploitation:** Attacker hosts a page with an iframe pointing at the crafted swfupload.swf URL, reloading it every 300ms. A victim who clicks the rendered text at the right moment triggers the javascript: URI in the imgur.com origin, yielding reflected XSS.
**Insight:** Flash SWFs that reflect parameters into HTML can be XSS sinks even when a competing event handler seems to block clicks; rapid iframe reloads from cache can open a race window to land the click first.