# HTTP header injection in info.hackerone.com allows setting cookies for hackerone.com

CRLF injection in info.hackerone.com URL path let attacker inject Set-Cookie with Domain=.hackerone.com, setting cookies on the parent domain.

- Payout: hidden
- Severity: medium
- Program: HackerOne
- Found by: harisec
- Disclosed: 2015-12-02
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/97292
- Library page: https://bugbountylibrary.com/r/h1%3A97292
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:nginx vuln:crlf-injection

**Target:** info.hackerone.com web server URL path handling
**Root cause:** The server reflects the URL path into response headers without stripping CRLF sequences, allowing injected header lines. A space after 'Domain' bypassed code that auto-set the cookie domain to info.hackerone.com.
**Steps:**
1. Send `GET /%0d%0aset-cookie%20%3amycookie%3dmyvalue;%20%44omain%20%3d.hackerone.com HTTP/1.1` with `Host: info.hackerone.com`
2. Observe response contains injected `Set-Cookie: mycookie=myvalue; Domain =.hackerone.com`
3. Visit `http://info.hackerone.com/%0d%0aset-cookie%20%3amycookie%3dmyvalue;%20%44omain%20%3d.hackerone.com` in Internet Explorer 11
4. Check `document.cookie` on hackerone.com shows `mycookie=myvalue`
**How found:** Researcher tested URL path for CRLF injection on a subdomain, noticed auto-domain-setting code and bypassed it by inserting a space after 'Domain'.
**Exploitation:** Attacker crafts a URL with encoded CRLF and Set-Cookie header; victim visiting it in IE receives a cookie scoped to .hackerone.com, enabling cookie injection/session fixation on the parent domain.
**Escalation:** Subdomain cookie injection escalates to setting cookies on the root domain hackerone.com, potentially enabling session fixation or overwriting cookies.
**Insight:** When a server auto-appends a cookie domain, try inserting whitespace (e.g. `Domain =`) to defeat the appended value and control the domain attribute yourself.