# XSS on player.vimeo.com without user interaction and vimeo.com with user interaction

Unescaped Vimeo username rendered in 'More from [name]' thumbnail overlay on player.vimeo.com and vimeo.com, enabling stored XSS via crafted username.

- Payout: hidden
- Severity: high
- Program: Vimeo
- Found by: stefanovettorazzi
- Disclosed: 2017-08-31
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/96229
- Library page: https://bugbountylibrary.com/r/h1%3A96229
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:high tech:rest technique:source-review vuln:xss

**Target:** player.vimeo.com video player and vimeo.com video page
**Root cause:** The user's display name is inserted into the 'More from [name]' thumbnail overlay without HTML escaping, so markup in the name executes as script.
**Steps:**
1. Set Vimeo display name to `<svg onload=eval(name)></svg>` (length limit still permits it).
2. Set `window.name` to the desired JS payload, e.g. `prompt(document.domain,document.cookie)`.
3. Load the crafted `name_xss_iframe.html` and wait ~10s; payload executes on https://player.vimeo.com.
4. Load `name_xss.html`, click 'Watch video', play the video, wait ~10s; payload executes on https://vimeo.com.
**How found:** Noticed the 'More from [name]' thumbnail overlay at the end of each video renders the username, and tested whether the name field was escaped.
**Exploitation:** Attacker controls their own username containing an SVG onload handler; victim viewing the attacker's video triggers the overlay rendering, and eval(name) pulls the payload from window.name set by the framing page, executing in the Vimeo origin to read cookies/domain.
**Insight:** Username/display-name fields echoed into player overlays and end-of-video cards are a recurring stored-XSS sink; the window.name + eval(name) trick bypasses length limits on the name field.