0

I've found that a user input was passed to jquery selector sink $() This is known to be vulnerable because having something like :

$("<img src='/' onerror=alert('xss');>")

Will result in an alert in the page

But in this case the user input was added to a class selector so the query looks like :

$(.somethingX)

Where X is the user input And because of that when adding something like a tag , it results in an error :

Uncaught Error: Syntax error, unrecognized expression: .someting <img src='/' onerror=alert('xss');>

So the question will be is there a way to bypass that and get xss ? Is appending something to the user input in this case enough to be secure ?

I've also tried to add something like valid class and then add h1:contains('payload') but this will not create the dom element ,because I think it was patched by jquery .

Thanks .

5
  • When you can inject input into a jquery selector, you already are in a JavaScript context. What prevents you from simply writing JavaScript code directly instead of trying to use the HTML document to trigger the code? Let's say the vulnerable code is $('.foo<input here>').bar();. Why not use $('.foo'); alert('XSS'); //').bar();? If there's some specific restriction which prevents this, then you need to mention that in your question.
    – Ja1024
    Commented Aug 25 at 2:57
  • See also Is XSS possible with jQuery(location.hash)?
    – Sjoerd
    Commented Aug 25 at 11:09
  • @Ja1024 I interpreted the injection as client-side script running $('.somethingX ' + userinput).
    – Sjoerd
    Commented Aug 25 at 11:11
  • @Ja1024 It takes the user input into a variable and then do as @Sjoerd said : $('.somethingX ' + userinput) which make it not possible to close the selector and you will get the same error . Commented Aug 25 at 11:19
  • @Sjoerd the only thing from the link you mentioned is timing attack , is it the only possibility ? Commented Aug 25 at 11:23

0

You must log in to answer this question.

Browse other questions tagged .