Is carrying out an XSS attack possible?
- 1 < to get into a tag context
- 1+ [a-z] for the tag name
- 1 space
- 1+ [a-z] for the attribute (in practice, the shortest event attribute that currently exists is onload, which is 6 characters)
- 1 =
- your payload
That means even in an ideal situation, you only have 5 characters for your payload. Even if something like jQuery is already loaded, loading a remote script takes more characters than that.
In reality, you don't even have 5 characters. The shortest attribute is 6 characters, but onload doesn't work with img without a valid src, so onerror is shorter, giving you
<img onerror= src=a> (20 characters). With a body tag, you could reduce this a bit:
<body onload=> (14 characters), which is still too long. And you still need your payload, which will be a minimum of ~25 characters (eg
This means that in your situation, script tags would actually be shortest. But you would only get to
<script sr with 10 characters.
You can't even inject a link, which may possibly be used for phishing, as an a tag is cut of as well:
If not, how should I report this vulnerability to the application owner?
Is the length of the text configurable? In that case this would still be a valid vulnerability.
If it is not configurable, I wouldn't consider it an exploitable vulnerability, but I would still report it (at least if I am contacting them anyways because of further issues), as it may become an issue in the future in case the vendor decides to show more characters.