DOM XSS : Need Help

Question

I was trying my hands at DOM based XSS. I came across a scenario where user controlled string from the URL is included in javascript as below

var userControlled=substring of URL;
window.location="/abc/xyz?param="+userControlled;

URL is something like http://mydomain/param1=qwerty where I can enter any value for param1 and system would not complain

Note: Value of param1 does not directly appear anywhere in the response but it is used using DOM

or can be http://mydomain/param1=qwerty#sadsdsdsd

I was just wondering is there a way to redirect user to a different domain or execute a script or anything which can help me execute a successful XSS attack. Or any other attack for that matter.

Answer 1

This snip of JS is not vulnerable to DOM based XSS. I recommend using the DOM Snitch plugin for auditing applications for DOM based XSS.

Answer 2

This snippet of code suffers does not have an XSS flaw but it does suffer from parameter splitting. It allows the user to specify extra GET parameters which can allow escalation of privileges when the request carries credentials such as a CSRF token in an earlier parameter or authorization cookies.

For example, if userControlled is

&start-world-war-iii=true

then the browser will GET /abc/xyz?param=&start-world-war-iii=true with the user's cookies.

It's probably low risk since assigning window.location leads to a GET request which rarely have side-effects that can be abused by the carried credentials.

To mitigate this, userControlled should be normalized:

window.location="/abc/xyz?param=" + encodeURIComponent(userControlled);