# Improper handling of Chunked data request in sapi_apache2.c leads to Reflected XSS

PHP's Apache SAPI mishandled chunked request bodies, echoing attacker-controlled chunk data into the 400 error response, yielding reflected XSS on any endpoint.

- Payout: $500
- Severity: medium
- Program: Internet Bug Bounty
- Credited: cymtrick
- Disclosed: 2018-10-02
- CVE: CVE-2018-17082
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/409986
- Library page: https://bugbountylibrary.com/r/h1%3A409986
- Tags: domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:php technique:source-review vuln:xss

**Target:** sapi_apache2.c chunked request handling
**Root cause:** The brigade bucket inserted via APR_BRIGADE_INSERT_TAIL is destroyed by other handlers, so leftover chunked body data leaks into the error response body.
**Steps:**
1. Send a POST with `Transfer-Encoding: chunked` and a body containing `<script>alert(1)</script>`
2. Trigger a 400 Bad Request (malformed chunked framing)
3. Observe the script reflected unescaped in the Apache error page body
**How found:** Researcher noticed chunked requests could inject HTML at any endpoint, traced via gdb that the brigade bucket holding chunk data was destroyed by other handlers and leaked into the response.
**Exploitation:** Attacker crafts a chunked request whose body contains HTML/JS; the server's 400 error response echoes the chunk data, executing script in the victim's browser context.
**Insight:** Chunked transfer-encoding bodies can bypass normal body handling and leak into error responses; test malformed chunked framing against error paths to find reflected content.