# CRLF injection on www.starbucks.com

CRLF injection in Starbucks email-prospect endpoint allowed arbitrary header injection and HTTP response splitting via encoded %0d%0a in the URL path.

- Payout: hidden
- Severity: medium
- Program: Starbucks
- Found by: x3n0nn3p
- Disclosed: 2020-09-01
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/858650
- Library page: https://bugbountylibrary.com/r/h1%3A858650
- Tags: area:web domain:web impact:dos impact:integrity kind:bounty platform:hackerone sev:medium technique:param-pollution vuln:crlf-injection

**Target:** www.starbucks.com/email-prospectt endpoint (web)
**Root cause:** The email-prospect endpoint reflected URL path content into response headers without stripping CR/LF sequences, allowing header injection and response splitting.
**Steps:**
1. Send `curl -i 'https://www.starbucks.com/email-prospecttg9wh%0d%0aset-cookie:foo%0d%0a%0d%0a4t6uf?requesturl=/responsibility/global-report/policies' -d 'newsletter_signup_email=&newsletter_signup_zipcode=&newsletter_placement=footer' --http1.1`
2. Observe injected `set-cookie:foo` header and split response body in the reply
**Exploitation:** Attacker crafts a URL with %0d%0a sequences in the path to inject arbitrary response headers (e.g. Set-Cookie, CORS headers) and split the HTTP response, enabling cookie injection and potential Ajax-based data theft.
**Escalation:** Chaining injected CORS headers with Ajax requests to steal authenticated data; DoS via oversized cookies.
**Insight:** Path segments reflected into response headers are a CRLF sink; test encoded %0d%0a in URL path components of endpoints that build headers from request data.