Example of reflected client XSS which is not DOM based XSS

Question

Given that I categorize XSS in a matrix of {client,server}x{stored,reflected} and treat DOM XSS as a subset of client XSS, can there be a reflected client XSS which is not DOM based? I cannot find or think of an example because all reflected values I can think of are accessed using DOM methods.

Answer 1

From those categorisations:

Client XSS occurs when untrusted user supplied data is used to update the DOM with an unsafe JavaScript call.

(em mine)

Therefore for it to be client XSS, it has to involve updating the DOM.

Although, the article goes on to say:

DOM Based XSS is simply a subset of Client XSS

I believe this is referring to the actual source being from the DOM rather than the server.

e.g.

foo.innerHTML = document.location.hash;

Rather than

foo.innerHTML = ajaxResult;

This is because the definition of DOM based XSS is as follows:

DOM Based XSS is a form of XSS where the entire tainted data flow from source to sink takes place in the browser, i.e., the source of the data is in the DOM, the sink is also in the DOM, and the data flow never leaves the browser.

So reflected client based XSS which is not DOM based is where the data itself is from the server (reflected in the response from the HTTP request), but the code is rendered on the page via JavaScript.

Example:

Request:

http://example.com?name=<svg onload=alert(1) />

(Name would be % encoded, but I've left it unencoded here for clarity.)

Response:

<script>
var name = "<svg onload=alert(1) />";
$('#output').html(name);
</script>

<div id="output">
</div>

Takeaways

What is probably important when it comes to XSS is the following:

• Any type of stored XSS is mostly higher risk than any form of reflected XSS. Browser XSS filters cannot stop them (except if a Content Security Policy is in place and is sufficiently locked down).
• When an XSS updates the DOM in a reflected XSS attack, this bypasses browser XSS filters too (same caveats in regards to CSP).
• Server reflected XSS is less risky as it requires user interaction and there's also a good chance a browser XSS filter will block it.