Lab 183 — ArticleFlow — Stored XSS via Fat GET Cache Poisoning

hackadvisor

Task: Blogging platform with JSONP localization endpoint behind Nginx cache; Express.js accepts GET body params while Nginx keys cache on URL only. Solution: Fat GET cache poisoning — override callback parameter via request body to inject XSS payload into cached JSONP response, exfiltrate admin cookies via same-origin comments API.