# Cache Poisoning Allows Stored XSS Via hav Cookie Parameter (To Account Takeover)

hav cookie reflected into cacheable .js response; double-quote stripping bypassed WAF, stored XSS poisoned cache, session leaked via INITIAL_STATE enabling account takeover.

- Payout: hidden
- Severity: high
- Program: Expedia Group Bug Bounty
- Found by: bombon
- Disclosed: 2023-04-01
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/1760213
- Library page: https://bugbountylibrary.com/r/h1%3A1760213
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:high tech:payment technique:chained technique:source-review vuln:account-takeover vuln:cache-poisoning vuln:xss

**Target:** www.abritel.fr .php.js listing endpoint with hav cookie reflection
**Root cause:** The hav cookie value is reflected unescaped into a JavaScript variable in a cacheable response; the WAF only strips double quotes, so splitting tags with quotes evades it while < and > still close the script tag.
**Steps:**
1. Send `GET /annonces/location-vacances/france_midi-pyrenees_46_stcere_dt0.php.js?xxxd` with `Cookie: hav=xss"</sc"ript><sv"g/onloa"d=aler"t"(document.doma"in)>`
2. Observe response reflects `var hav="xss</script><svg/onload=alert(document.domain)>"` after quote stripping
3. Visit the cached URL `/annonces/location-vacances/france_midi-pyrenees_46_stcere_dt0.php.jpeg?xxxd` from another browser to trigger the poisoned cache
4. Use payload reading `window.INITIAL_STATE.system.cookie` to exfiltrate the HTTPOnly session value
**How found:** Noticed hav cookie reflected in a .js response; tested WAF behavior and found it only stripped double quotes, so inserting quotes inside tags split the blocked strings while < and > still formed valid tags.
**Exploitation:** Attacker poisons the cacheable .js endpoint via the hav cookie so any visitor loading the cached response executes attacker JS; since the session cookie is exposed in window.INITIAL_STATE.system.cookie, the script exfiltrates it and the attacker replays it to take over accounts.
**Escalation:** Chained cache poisoning + WAF bypass + JS-variable session leak to escalate reflected XSS into full account takeover.
**Insight:** When a WAF strips a specific character (quotes), test whether splitting blocked tokens with that character reconstructs valid HTML after stripping; also check cacheable .js endpoints for cookie reflection and look for session tokens in JS state objects when cookies are HTTPOnly.