Ajax request header manipulation (DOM-based)
Summary: PortSwigger describes DOM-based Ajax request header manipulation as a flaw where a client-side script writes controllable data, such as URL input, into a header of an XmlHttpRequest. An attacker can then build a URL that, when visited by another user, sets an arbitrary header in the resulting Ajax request.
What's compelling: The impact rests entirely on what that header controls on the server: if it governs the behavior of the Ajax request, an attacker can make the user perform unintended actions. PortSwigger also notes that static analysis alone produces false positives, so a finding without dynamic evidence needs code review before you treat it as real.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026