Ajax request header manipulation (stored DOM-based)
Summary: PortSwigger describes stored DOM-based Ajax request header manipulation, which occurs when user input is stored and later embedded into the DOM, where a client-side script writes that controllable data into a header of an XmlHttpRequest. An attacker may then construct a URL that, when visited by another user, sets an arbitrary header in the subsequent Ajax request, with impact depending on the role that header plays in the server's processing.
What you should know: If the manipulated header controls the behavior of a privileged action, an attacker can make another user perform unintended actions simply by getting them to visit a crafted URL. PortSwigger also notes that static analysis alone can produce false positives, so a finding without dynamic evidence needs code and execution-path review before you can rule it out.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026