Lab 410 — HelpWise — Reflected XSS via Markdown Greeting in AI Chat

hackadvisor

Task: HelpWise support app renders the AI-chat `greeting` parameter as markdown via the `marked` library with no sanitization and no CSP. Solution: a literal double-quote inside markdown image URL syntax (![a](x\"onerror=\"JS)) breaks out of the generated src attribute and injects an auto-firing onerror handler; reporting the crafted /search URL to the admin bot leaks its non-HttpOnly admin_flag cookie to the lab Interaction Server.