Lab 223 — RelayDock — CORS Misconfiguration in Internal Config API

hackadvisor

Task: Webhook management platform with HTML template preview system reviewed by admin bot; internal Config Service on port 3001 with misconfigured CORS. Solution: Stored XSS in template preview fetches internal config API via CORS, base64-encodes response, exfiltrates to Interaction Server via Image src URL path; flag found in secrets.platform_master_key.