Modify Javascript Variable with URL Exploit

Question

Is it possible to set a javascript variable through the URL?

Here's an example of the code I'm trying to modify:

<script type="text/javascript">

var x = 0;

</script>

Is there a way to modify that variable through a browser, for instance, www.somewebsite.com + (something that changes 'x' variable)?

Related on Stack Exchange:https://stackoverflow.com/questions/39023761/modify-javascript-variable-with-url

Answer 1

No, this is not possible without an XSS vulnerability. If such a thing were generally possible, XSS would run rampant and you could execute any arbitrary code on any page, which would be bad.

Now if the code had a reflected XSS attack vector, or an DOM-based XSS attack vector, the the URL could be used to deliver a JavaScript payload. Of course, this would only be possible if the server-side or JavaScript code had such a security vulnerability (if your code makes that possible, then you should fix it).

Answer 2

Similar attacks are possible, without XSS.

Say the code was

<script type="text/javascript">

var x = 0;

// Some processing

x=395;

</script>

If the attacker wants the value of x not to be affected by the x=395 they could use the browser's anti-XSS filter in order to filter out the code.

e.g. By creating a crafted link to send to their victim:

example.com/page.html?param=x%3d395%3b

The XSS filter will detect that the parameter value is reflected in the output (x=395;), and block execution of it.

Therefore, the original value of x will remain.

In order to mitigate this, set the user's browser's XSS filter to block rather than to filter using security headers:

X-XSS-Protection: 1; mode=block