DeskFlow — Session Fixation via Support Ticket URL

hackadvisor

Task: Express.js support ticket platform where admin bot visits reference URLs; connect.sid accepts ?sid= query parameter and session ID doesn't rotate after login. Solution: Session fixation — submit ticket with reference_url pointing to http://localhost:8080/login?sid=ATTACKER_SID, admin bot authenticates with that SID, then reuse it to access /admin/dashboard.