There is an application which is vulnerable to HTTP Response Header Injection. Here is my observation till now.
If I browse to the URL
I get a 302 redirection response with following header
HTTP/1.1 302 Found Date: Thu, xxxxxx Cache-Control: no-store Location: https://othersite.com/abcd/xyz ABC
But when I tried to set a cookie value and send a URL which looks like this,
this is the response I got,
HTTP/1.1 302 Found Date: xxxx Cache-Control: no-store Location: https://othersite.com/abcd/xyz Set-Cookie%3a%20Cookie%3dvalue
Is it exploitable?
What else attack vectors can I try?
Edit: As Sravana asked how abc.com and othersite.com are related, so this request is before login in the application. Login is done via OAuth. Any request made to abc.com is taking the user to othersite.com. Now I think as this is before login, will set-cookie make sense?