# Length extension attack leading to HTML injection

Zomato redirect endpoint signed URLs with md5(secret+url), allowing a hash length-extension attack to append HTML and inject content into the redirect page.

- Payout: $100
- Severity: medium
- Program: Eternal
- Credited: b1t
- Disclosed: 2017-09-01
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/251572
- Library page: https://bugbountylibrary.com/r/h1%3A251572
- Tags: domain:web impact:integrity kind:bounty platform:hackerone sev:medium technique:source-review vuln:crypto vuln:open-redirect

**Target:** /redirect endpoint with md5(secret+url) signature
**Root cause:** Signature was md5(secret || url) instead of HMAC, making it vulnerable to length extension; the redirect page also rendered the URL unescaped.
**Steps:**
1. Observe `https://www.zomato.com/redirect?u=xxx&t=yyy` where t validates md5(secret+u)
2. Use hash_extender with known url, hash, and guessed secret length to forge extended url + new hash
3. Craft `u` with padding bytes, null byte to break the Refresh header, then `%3Cstyle%3E...%3C/style%3E` HTML payload
4. Request `https://www.zomato.com/redirect?u=<forged>&t=<forged_hash>` and observe injected HTML rendered
**How found:** Blackbox testing of the profile website redirect parameter; deduced the signature scheme was md5(secret+url) and recognized length-extension applicability.
**Exploitation:** Forge a valid signature via length extension, append a null byte to stop the Refresh redirect, and inject arbitrary HTML into the 'Redirecting you to...' page. XSS was blocked by WAF, so impact limited to HTML injection.
**Insight:** When a redirect/signature param uses a hash of secret+message, test hash length extension; a null byte in the URL can also break downstream Refresh headers to keep the page rendering attacker content.