Is carrying out an XSS attack possible?
No, 10 characters is not enough to exploit this. If you want to enter a JavaScript context, at the very minimum, you would need:
- 1 < to get into a tag context
- 1+ [a-z] for the tag name
- 1 space
- 1+ [a-z] for the attribute (in practice, the shortest event attribute that currently exists is onload, which is 6 characters)
- 1 =
- your payload
That means even in an ideal situation, you only have 5 characters for your payload. Even if something like jQuery is already loaded, loading a remote script takes more characters than that.
In reality, you don't even have 5 characters. The shortest attribute is 6 characters, but onload doesn't work with img without a valid src, so onerror is shorter, giving you <img onerror=[] src=a>
(20 characters). With a body tag, you could reduce this a bit: <body onload=[]>
(14 characters), which is still too long. And you still need your payload, which will be a minimum of ~25 characters (eg $.getScript('http://x.c')
).
This means that in your situation, script tags would actually be shortest. But you would only get to <script sr
with 10 characters.
You can't even inject a link, which may possibly be used for phishing, as an a tag is cut of as well: <a href=ht
If not, how should I report this vulnerability to the application owner?
Is the length of the text configurable? In that case this would still be a valid vulnerability.
If it is not configurable, I wouldn't consider it an exploitable vulnerability, but I would still report it (at least if I am contacting them anyways because of further issues), as it may become an issue in the future in case the vendor decides to show more characters.