CODEWITHSUNDEEP
javascripthtmlsecuritybrowserxss
Yousef Amar
Yousef Amar

Reputation: 661

Is an XSS attack possible under these constraints?

The output is:

<img src="http://example.com/[input]"
     oncontextmenu="openUrl('http://example.com/[input]')">

Where [input] is the user input, which is sanitised through this function:

a => {
  a = String(a);
  a = this.replaceAll(a, "&", "&amp;");
  a = this.replaceAll(a, '"', "&quot;");
  a = this.replaceAll(a, "'", "&#39;");
  a = this.replaceAll(a, "<", "&lt;");
  return a = this.replaceAll(a, ">", "&gt;")
}

in other words, we seemingly can't break out or use quotes of any kind?

Is an XSS attack possible at all under these constraints? Or is it possible to redirect the user to any domain besides example.com? Or indeed, load an image from (or make a request to) evil.com? Thanks!

Upvotes: 0

Views: 281

Answers (1)

Bergi
Bergi

Reputation: 665455

Yes, this is a XSS vulnerability.

While you do escape the HTML attribute syntax fine (so that nothing can break out of the src and oncontextmenu values), it does lack

  • validation of the example.com path. src attribute values can be malicious on their own, and if someone gets the visitor to load http://example.com/logout, http://example.com/user-content?from=eve&file=bad-icon or http://example.com/redirect.php?target=evil.com/, they might have won. Yes, this depends on who controls example.com and possible vulnerabilities in there, but getting the victim to load certain URLs is part of many attacks.
  • escaping of the JS string content! Let's say input is '.replace(/.*/,'evil.com')+', you will end up with oncontextmenu="openUrl('http://example.com/'.replace(/.*/,'evil.com')+'')". The HTML entities won't help you there - &apos; in the attribute becomes ' in the script.

Upvotes: 2

Related Questions