Cross-Site Scripting to Local File Inclusion on Trello’s Appby@ajdumanhug
9,386 reads

Cross-Site Scripting to Local File Inclusion on Trello’s App

Read on Terminal Reader

Too Long; Didn't Read

Companies Mentioned

Mention Thumbnail
Mention Thumbnail
featured image - Cross-Site Scripting to Local File Inclusion on Trello’s App
Aj Dumanhug HackerNoon profile picture


Aj Dumanhug
react to story with heart

Report Status: Fixed

Trello is a collaboration tool that organizes your projects into boards. In one glance, Trello tells you what’s being worked on, who’s working on what, and where something is in a process.

They launched their Bug Bounty Program on February 2nd, 2015. They pay bounties in exchange for a valid bug starting from $256 up to $4096, depending on the severity of the bug.


Trello allows its users to upload a file through their mobile application. By observing how does the upload feature work, I noticed that some file types executes directly on the Trello app.


I created a file with .svg file extension containing a malicious script that will execute once accessed or opened.

<?xml version="1.0" encoding="UTF-8" standalone="yes"?><svg xmlns=""><script>alert(document.location);</script></svg>

After uploading the file above on Trello’s app, I successfully executed a simple Cross-Site Scripting.


Cross-Site Scripting on Trello

Then, I noticed that the file was not just uploaded in their third party service storage but it was also uploaded locally. That is why I quickly remembered that it was possible to perform a Local File Inclusion.

So, I created another payload inside the .svg file that will locate, access, and execute the /etc/passwd file.

<?xml version=”1.0" encoding=”UTF-8" standalone=”yes”?><svg xmlns=”"><script>function readTextFile(file){var rawFile = new XMLHttpRequest();“GET”, file, false);rawFile.onreadystatechange = function (){

  if(rawFile.readyState === 4){  
     if(rawFile.status === 200 || rawFile.status == 0){  
        var allText = rawFile.responseText;  


After uploading the new .svg file, I successfully displayed the content of /etc/passwd file.



Right after the discovery of security vulnerability, Trello triaged and fixed it in version 4.0.8.

Verifying the Fix

Shown below is the screenshot of the fix applied by Trello.


If you’d like to try bug bounty hunting or report a possible security vulnerability, you may view their Bug Bounty Program Policy on HackerOne.


. . . comments & more!
Hackernoon hq - po box 2206, edwards, colorado 81632, usa