Stored xss in editor

Summary

On March 28th, 2015 @sahilsaif reported an issue with stored XSS in Mapbox Editor (www.mapbox.com/editor). We deployed a fix for this issue on March 30th, 2015.

On March 28th, 2015, I found a Stored XSS in Mapbox Editor.

Which was hosted on https://mapbox.com/editor Mapbox Editor is now deprecated and replaced with Mapbox Studio. (https://mapbox.com/studio).

This Issue was very straight forward.

Following was the Reproduction Steps.

1. Go to: http://mapbox.com/editor

2. Draw a line on the map using tool bar.

3. Give the name to the created line.

4. Enter Following JS payload on Name & Description Input Box.

"><img src=x onerror=prompt(111);>

5. Save it.

6. Reload the Page, Js payload will be executed.

Exploitation: You can share the created maps to other Mapbox users and js payload will be executed on the targetted browser.

Screenshot

https://www.dropbox.com/s/2lxd8fhw1bttwrh/Screen_Shot_2015-03-28_at_9.44.25_AM.png?dl=0

-Sahil