4

I found a reflected XSS in an application during a test, where I define the string passed to:

<script language='JavaScript'>
document.location='/this-is-my-input'
</script>

Some input sanitisation occurs, for instance my string is only recorded after the first /. So I've managed to escape the document.location command by URL encoding /'//\nalert(1), which runs the alert(1), but immediately redirects me to the root / of the webapp.

Is there anything I can do to prevent the change of the document location?

edit: With the above mentioned user input, the code looks as follows:

<script language='JavaScript'>
document.location='/'//
alert(1)//'
</script>
  • 1
    could you try '//\nalert(1);window.history.back() ? if that doesn't work, it might be a 500 error with a redirect to root as default behaviour – J.A.K. Feb 3 '17 at 13:04
  • That would redirect me twice, wouldn't it? Once to / then back. I tried it and it didn't work and the console wasn't informative either, but thank you. – SaAtomic Feb 3 '17 at 13:10
  • 1
    I misspoke, the console is for JS errors. If the server doesn't hide it, a 500 range code could be visible in the 'network' tab of your browser debugger. If it is in fact a server side error, there's little you can do except work around it – J.A.K. Feb 3 '17 at 13:14
  • 1
    What happens if you set the document location to your current page, but with a # at the end? Some browsers ignore redirections which are to the current page, in some cases. – Matthew Feb 3 '17 at 13:21
  • 1
    what about /+window.location.href+'//\nalert(1) ? – J.A.K. Feb 3 '17 at 13:45
2

Use hashfragments.

/'.replace(/^.*$/, document.location+"#") leads to document.location='/'.replace(/^.*$/, document.location+"#") which basically takes the current URL, and put a hash fragment after it. It won't reload the page since hashfragments doesn't do so on broswers.

Put whatever you want afterward like a ;alert(1).

Since the original code contains a ' (ie document.location='/'), then don't forget to discard it, using a comment (// or /*), or by leaving your last String value unclosed (ie write var x='My String and let the original ' close the string). Otherwise, it may raise a parse error and Javascript won't be executed at all.

  • beautiful! works like a charm! You were missing the // in the end, to invalidate the original closing tag ' of the document.location. – SaAtomic Feb 3 '17 at 14:43
  • 1
    @SaAtomic You can actually put anything else like /*, a simple ', or just not-closing your last Stirng value; that's why I didn't specified some ;) – Xenos Feb 3 '17 at 15:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.