CODEWITHSUNDEEP
javascriptsecurityxss
Mike Rifgin
Mike Rifgin

Reputation: 10745

Is an XSS exploit possible when injected code is output inside quoted html attributes

If I have a piece of HTML like so:

<div class=“feature-some-id”>

and some-id portion of the class has originated from user input via a query param, and that query param has not been escaped on the sever I am able to do this:

<div class=“feature-some-id</script>”>

The html is output via an express app like so:

res.render('my-template', {
  classNameSuffix: req.params.id
});

so it's raw user input.

Is there any way an attacker can break out of that script so that a script could be executed?

Upvotes: 0

Views: 66

Answers (1)

dave
dave

Reputation: 64657

If you can pass in a quote as part of the query param

?id=some-id"><script>alert()</script>

and have it end up, unescaped, in req.params.id, then you would get

<div class="feature-some-id"><script>alert()</script>

which obviously you could change alert() for any code you wanted to execute.

Upvotes: 2

Related Questions