Stored XSS on https://paypal.com/signin via cache poisoning

Summary

Due to a configuration in frontend, caching servers, it was possible for a researcher to use request smuggling to convert a page request into a cached redirect. If the cached redirect were accessed by a legitimate user, an attacker's content would be rendered instead of the requested page. While this would not impact any back-end data, this could interfere with the integrity of certain pages, including potential interference with the sign-in page. PayPal worked with the researcher and our technical teams to remediate the issue and confirm there was no evidence of real-world attacks.

I've posted a full writeup over at https://portswigger.net/blog/http-desync-attacks-request-smuggling-reborn