HTML injection that may lead to XSS on HackerOne.com through H1 Triage Wizard Chrome Extension

How it was found

To reproduce:

• ensure you have the H1 Triage Wizard Chrome extension enabled
• visit https://hackerone.com/reports/1622449?subject=security&/bugs=1
• right-click the report, select "View Triage Questionnaire (Beta)"
• observe an HTML payload being injected

{F2173699}

The payload is stored in █████████. The contents of this file are dynamically loaded through the Chrome extension.

The vulnerability is caused by the following code in the triage-extension-private repository:

buildTriageQuestionnaireModal = (
  modalElement,
  triageQuestionnaireModalOptions
) => {
  let questionnaireResponses =
    triageQuestionnaireModalOptions.questionnaireResponses;
  if (questionnaireResponses) {
    modalElement.innerHTML = triageQuestionnaireHTML
      .replace("{{handle}}", triageQuestionnaireModalOptions.handle) // <-- the handle here is taken from the subject parameter (i.e. "security")
      .replace("{{1}}", questionnaireResponses[1]) // <-- the response to the questionnaire is interpolated without sanitizing it
      .replace("{{2}}", questionnaireResponses[2]) // <-- this applies to all of these
      .replace("{{3}}", questionnaireResponses[3])
// ...

Impact

This vulnerability may lead to compromising confidential information or impact its integrity.