Lab 245 — MetriView — Reflected XSS via Open Redirect Chain

hackadvisor

Task: MetriView monitoring platform (Express/Node.js) with open redirect at /auth/redirect accepting encoded path traversal, and reflected XSS at /api/snapshot/render via unescaped title parameter. Solution: chain open redirect through path traversal to reflected XSS endpoint, use double-encoded %252B to survive redirect decoding, exfiltrate admin cookies via document.location redirect to notes API, retrieve flag from admin's cookies.