97 Things Every Application Security Professional Should Know

Chapter 58. Unveiling Paths to Account Takeover: Web Cache to XSS Exploitation

Lütfü Mert Ceylan

I am pleased to share with you a real-life experience on a security vulnerability that showcases the intricate interplay between seemingly benign technical nuances and profound security implications. In 2023, I embarked on a journey that led me to uncover a reflected XSS vulnerability within a video game company’s infrastructure. My investigation traversed the realms of caching mechanisms and vulnerability escalation, culminating in the discovery of a pathway to account takeover. In this discourse, I illuminate the technical underpinnings that drove this narrative.

Discovery of Vulnerability

At the heart of this narrative is a reflected XSS vulnerability lurking within the language input field. At its inception, it might have appeared as a conventional XSS vulnerability; however, a closer examination unveiled nuances that held the potential for drastic consequences. Upon accessing a specific URL, the vulnerability could be exploited to compromise user sessions through a meticulously crafted payload. The vulnerability stemmed from the absence of critical security measures such as the HttpOnly and secure flags.

But What Is Reflected XSS Vulnerability?

Reflected cross-site scripting (XSS) is a subtype of XSS where malicious scripts injected into a web application are reflected off ...