2

I was working on a web app and as I was building the front-end for a search function I tried to see if it would be vulnerable to XSS.

After pressing the search button, the js code will generate a paragraph with the search value and append it to the div, and when the paragraph exists it will just modify the innerHTML property.

After searching for <script>alert();</script> the paragraph looks like this <p id="results">Searched: <script>alert();</script></p>.

I was expecting this to trigger an alert. I tried it in Firefox and IE.

my code:

<!DOCTYPE html>

<head>
<meta charset="utf-8"/>

    <script>    
    var label_results;

    function search_function(){

        var label_results ="";

        if(document.getElementById("inputtext").value)
        label_results = "Searched: " + document.getElementById("inputtext").value;
        else label_results = "Missing term"

        if(document.getElementById("results"))
        {
            document.getElementById("results").innerHTML = label_results;
        } else  {
            var para = document.createElement("p");
            var node = document.createTextNode(label_results);
            para.id = "results";
            para.appendChild(node);
            var element = document.getElementById("search");
            element.appendChild(para);
        }

    }

    </script>

</head>
<body>

<div id="search">
    <input id="inputtext" type="text" name="search_value" placeholder="Search..">
    <input id="search_button" type="submit" value="Search" onclick="search_function()">
</div>
</body>
</html>

edit:I've added a snip of the source code

enter image description here

Improve this question
2
  • Are you certain that it isn't escaping the tags or something? Can you upload a screenshot of the HTML Source code with your reflection point? If it's not escaping your inputs (e.g. the tags) then I don't see why this isn't triggering... Does the website in question have a Content Security Policy?
    – MLT
    Commented Dec 17, 2019 at 12:50
  • I've uploaded a snip with the inspector in Firefox where it seems grayed out (in IE it looks normal, not grayed out). The tags seem escaped properly. So far it's not a website, just a local page.
    – Razvan
    Commented Dec 17, 2019 at 13:12

1 Answer 1

Reset to default
4

document.getElementById("results").innerHTML = label_results;

This is vulnerable to XSS. It interprets the label_results variable as HTML.

var node = document.createTextNode(label_results);

This is not vulnerable to XSS. It interprets label_results as text.

the paragraph looks like this <p id="results">Searched: <script>alert();</script></p>.

Are you sure? Are you using the inspector in the developer tools of the browser? That can't always be trusted to correctly distinguish between HTML and text.

Improve this answer
4
  • I was using only the inspector in the browser. When searching a second time the label_results variable should be interpreted as HTML, and it doesn't write/display the payload explicitly like the first time, but for some reason it won't trigger the alert. Did you manage to trigger the alert?
    – Razvan
    Commented Dec 17, 2019 at 12:23
  • @Razvan I don't want to post another answer because I just built off of your very helpful one Sjoerd. I can tell you what's happening though. It is vulnerable, but only on the second search (for the reason you already outlined Sjoerd). The issue is that (for reasons I don't remember and don't have a reference for) the .innerHTML function simply won't create script tags. As a result you have to use a different payload. Instead of using a script tag use something like this: <img src="" onerror="alert(1)"> Search for that twice and you'll get your alert.
    – Conor Mancone
    Commented Dec 17, 2019 at 14:00
  • Why don't you edit your answer to include that as an example payload?
    – Conor Mancone
    Commented Dec 17, 2019 at 14:01
  • I've run into this issue in non-security context, when trying to load pages dynamically into modals. If the page in question had its own separate script tags, then I had to parse the contents, remove the script tags, add the rest of the HTML to the modal, and then manually build and insert script tags onto the document body. I never dug too far into why you couldn't add script tags with innerHTML.
    – Conor Mancone
    Commented Dec 17, 2019 at 14:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .