Lab 283 — PulseMetrics — XSS via HTTP Response Splitting (CRLF Injection)

hackadvisor

Task: Marketing analytics platform with /track endpoint reflecting campaign parameter into X-Campaign-ID response header unsanitized, admin bot reviewing relative URLs. Solution: CRLF injection (double %0D%0A) in campaign parameter to split HTTP response and inject XSS payload, exfiltrated admin's flag cookie via unauthenticated /api/shared-reports endpoint.