Timeline for Is this a XSS vulnerability? I can't figure out why it's not working
Current License: CC BY-SA 4.0
6 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Dec 17, 2019 at 14:19 | vote | accept | Razvan | ||
| Dec 17, 2019 at 14:03 | comment | added | Conor Mancone |
I've run into this issue in non-security context, when trying to load pages dynamically into modals. If the page in question had its own separate script tags, then I had to parse the contents, remove the script tags, add the rest of the HTML to the modal, and then manually build and insert script tags onto the document body. I never dug too far into why you couldn't add script tags with innerHTML.
|
|
| Dec 17, 2019 at 14:01 | comment | added | Conor Mancone | Why don't you edit your answer to include that as an example payload? | |
| Dec 17, 2019 at 14:00 | comment | added | Conor Mancone |
@Razvan I don't want to post another answer because I just built off of your very helpful one Sjoerd. I can tell you what's happening though. It is vulnerable, but only on the second search (for the reason you already outlined Sjoerd). The issue is that (for reasons I don't remember and don't have a reference for) the .innerHTML function simply won't create script tags. As a result you have to use a different payload. Instead of using a script tag use something like this: <img src="" onerror="alert(1)"> Search for that twice and you'll get your alert.
|
|
| Dec 17, 2019 at 12:23 | comment | added | Razvan | I was using only the inspector in the browser. When searching a second time the label_results variable should be interpreted as HTML, and it doesn't write/display the payload explicitly like the first time, but for some reason it won't trigger the alert. Did you manage to trigger the alert? | |
| Dec 17, 2019 at 10:35 | history | answered | Sjoerd | CC BY-SA 4.0 |