# CRLF and XSS stored on ton.twitter.com

CRLF injection in ton.twitter.com URL path set arbitrary cookies, chained with stored XSS via uploaded image extension swap to force victim auth_token and execute JS.

- Payout: $1,680
- Severity: medium
- Program: X / xAI
- Credited: seifelsallamy
- Disclosed: 2017-07-05
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/191380
- Library page: https://bugbountylibrary.com/r/h1%3A191380
- Tags: domain:web impact:ato impact:integrity kind:bounty platform:hackerone sev:medium tech:cdn technique:chained vuln:crlf-injection vuln:xss

**Target:** ton.twitter.com image/DM data endpoint
**Root cause:** URL path reflected into Set-Cookie header without CRLF sanitization; uploaded images served with attacker-controllable extension/content-type allowing HTML rendering.
**Steps:**
1. Request `https://ton.twitter.com/1.1/ton/data/dm/x/%E5%98%8A%E5%98%8Dset-cookie%3A%20test%3Dtest...` and observe `test` cookie set (CRLF via %E5%98%8A%E5%98%8D).
2. Upload a `.jpg` containing HTML/JS, send via DM, get source URL `.../AbCdEf.jpg:large`.
3. Replace `:large` with `%23.html` to render as HTML and trigger XSS popup.
4. Chain: use CRLF to inject attacker's `auth_token` cookie into victim, then redirect to injected image URL so it renders and executes JS.
**How found:** Noticed CRLF-encoded chars (%E5%98%8A%E5%98%8D) in path reflected into Set-Cookie, and that image extension could be swapped to .html to change rendering.
**Exploitation:** Attacker injects own auth_token via CRLF Set-Cookie, then redirects victim to the injected image URL; ton.twitter.com authorizes the image using the injected token, rendering attacker HTML/JS in victim's browser for phishing or malware delivery.
**Escalation:** Combining weak CRLF cookie injection with stored XSS to bypass the DM follow requirement and force the injected image to render for any victim.
**Insight:** Look for CRLF-encoded Unicode in URL paths that get reflected into response headers, and test whether CDN/image endpoints honor attacker-supplied extensions or content-type overrides to convert stored files into HTML.