# XSS on https://partners.acronis.com/

DOM XSS on Acronis partners login page via HTML-encoded back parameter bypassed with JavaScript unicode escapes, enabling script execution and credential theft.

- Payout: hidden
- Severity: low
- Program: Acronis
- Found by: yash_
- Disclosed: 2021-06-17
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/979204
- Library page: https://bugbountylibrary.com/r/h1%3A979204
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:low technique:unicode-normalization vuln:xss

**Target:** partners.acronis.com login page (login.html back parameter)
**Root cause:** The `-back` query parameter is HTML-encoded but then used to create and append an element to the form via DOM, so HTML entities are decoded and injected as markup; JS unicode escapes bypass the encoding.
**Steps:**
1. Open `https://partners.acronis.com/en-us/profile/login.html?-back=test123">` and inspect `var back =`; value is HTML-encoded but used to create/append an element to the form.
2. Replace `"` with `\u0022`, `>` with `\u003e`, `<` with `\u003c` in payload `"><img src=x onerror=alert(1)><x y="`.
3. Visit `https://partners.acronis.com/en-us/profile/login.html?-back=\u0022\u003e\u003cimg+src=x+onerror=alert(1)\u003e\u003cx+y=\u0022`.
4. Alert fires, confirming DOM XSS.
**How found:** Researcher noticed the `-back` parameter was HTML-encoded but still used to create and append an element to the form, hypothesizing the encoding could be bypassed; tried JavaScript unicode escapes for `"`, `<`, `>` to defeat the HTML encoding.
**Exploitation:** Attacker crafts a URL with unicode-escaped HTML in the `-back` parameter; when a victim opens it on the login page, the injected img onerror executes JavaScript in the Acronis origin, allowing credential phishing/theft.
**Insight:** When a reflected value is HTML-encoded but later inserted via DOM element creation, HTML entities get decoded—try JS unicode escapes (\u003c, \u003e, \u0022) to smuggle markup past the encoder.