Is there an XSS vector for hidden input fields without using the HTML accesskey?

Question

I have some cases of cross-site scripting (XSS) in hidden HTML input fields. There are some known XSS vectors that can be used for example using the HTML accesskey.

XSS in hidden inputs is frequently very difficult to exploit because typical JavaScript events like onmouseover and onfocus can't be triggered due to the element being invisible. Source: http://blog.portswigger.net/2015/11/xss-in-hidden-input-fields.html

But the use of an so called accesskey takes a high user interaction. Is there another way to inject code here and have it execute without keypresses or a milder form of user interaction?

In my current case the three characters ()> are filtered.

I need an XSS vector that can be injected in this position:

<input type="hidden" name="[INJECTION]" />

Another reference to the accesskey XSS trick can be found here: https://www.davidsopas.com/xss-on-a-input-hidden-field/

Answer 1

Unless you can inject to change the type (e.g. to text), then there is no known vector to trigger XSS within a hidden input field without further user interaction.

e.g. With

<input name="[INJECTION]" type="hidden" />

You could inject

" type="text" onfocus="alert('xss')" autofocus="1

to render

<input name="" type="text" onfocus="alert&#x28;'xss'&#x29;" autofocus="1" type="hidden" />

However, unless you can get in before the already set type="hidden" or close the tag and start a new one (which you can't in your case due to filtered >), you're snookered.