Lab 321 — MailPulse — Stored XSS via HTML Desanitization

hackadvisor

Task: MailPulse email platform sanitizes rich HTML then inline-renders it (Roundcube html4inline style); an admin bot reads all messages. Solution: the stage-1 CSS filter re-emits a CSS single quote as a RAW double quote inside the style attribute, breaking out of it after the second stage with no re-sanitization; inject onanimationstart on a Bootstrap keyframe to auto-fire stored XSS and exfiltrate the admin's non-HttpOnly flag cookie via the Interaction Server.