HTML injection (with XSS possible) on the https://www.data.gov/issue/ using media_url attribute

Summary

Thanks to the 18F team for the great experience, fast fix, and the bounty!

This XSS was undetectable by the most XSS scanners due to WAF in place. I noticed the reflection upon exploring the huge list of URLs (grabbed from the Google Search) manually. The WAF bypassing was an actual pain - it blocked almost all (but not all!) useful things (tags, events, etc.). There were 3 endpoints in total, affected by this issue.

References

Thanks to the @brutelogic and his awesome filter and WAF evasion tips on the @brutalsecrets - one of those tips helped me to bypass the Kona WAF after 6 hrs of pain. You may notice, that I even used the brute tag in the payload:)