Reflected cross-site scripting (XSS) on api.tiles.mapbox.com

Summary

On April 28th, 2016 @dawgyg reported a reflected cross-site scripting issue in the map embed page of our v4 map API that affected Firefox users only. An attacker could manipulate the access_token query string parameter on api.mapbox.com or api.tiles.mapbox.com to inject arbitrary JavaScript that would then execute in the context of the page.

The attack exploited an interpolated underscore template (<%=) that did not HTML-escape the value. In addition, Firefox does not encodeURIComponent() the single quote character (%27 or ') in the address bar. Both of these factors allowed an attacker to add a single quote character to break out of several meta HTML elements on our map embed page and add arbitrary script elements for Firefox users.

To resolve this issue we switched to HTML-escaped underscore templates (<%-). We deployed the fix to our servers and resolved the issue on April 29th, 2016.

This report only affected infrastructure running on api.mapbox.com and api.tiles.mapbox.com - it did not affect any of Mapbox's open source libraries such as mapbox.js or Mapbox GL JS. In addition, this issue also only affected Firefox users - Chrome, Safari, and Internet Explorer users were not affected.