2

Is it possible to inject javascript inside of an HTML option tag?

For example, say you have the following html:

<select>
    <option MALISCIOUS_CODE_HERE>Option Description</option>
</select>

If you were unable to break out of the tag itself, are there any attributes which would allow you to run javascript (or any other tricks) in this scenario? If this were a div, you could add an onclick event and run javascript this way for example.

2
  • onload isn't supported in the option tag (w3schools.com/jsref/event_onload.asp) Dec 2, 2021 at 18:57
  • Lots of options ... all depends on what else is going on ... browser, delivery, injection method etc ... <option f="""><SCRIPT>alert("XSS")</SCRIPT>"\>">Option Description</option> Dec 2, 2021 at 20:19

1 Answer 1

2

There are quite a number of valid event attributes for an option tag.

portswigger has a nice list of event attributes for any given tag (just select the option as tag).

onclick eg works in firefox:

<select>
<option onclick="alert(1)">test</option>
</select>

It will execute when you select (ie click on) the option in question.

onfterscriptexecute will work in firefox without user interaction, as long as the page contains javascript that will execute:

<option onafterscriptexecute=alert(1)><script>1</script>

portswigger is a bit outdated on Chrome (most of the payloads I tried do not work anymore), but eg this still works:

<style>@keyframes x{}</style>
<select><option style="animation-name:x" onanimationend="alert(1)"></option>
</select>

It requires a pre-defined animation code (via keyframes) on the target page though.

1
  • That's perfect, thank you! The XSS Cheat-sheet on Portswigger is exactly what I needed Dec 6, 2021 at 8:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .