6

I just expiremented with xss in my own server. I wrote code like this:

<?php
    if (isset($_POST['data'])) { 
        echo "<a href='".htmlentities($_POST['data'])."'>Click Here</a><br/>";
    }
?>

Here is a little vuln: as a post data we can send something like

   test' onerror=alert(1)

After sending we got line like this:

enter image description here

The question is: Is there any ways to bypass Chrome xss filter in this case?

  • 1
    As with any system, it is likely fallible, if someone knows how to bypass it, it would be an 0day. In short: there probably is a way to bypass it, but nobody who know how to is going to tell you. – Nick Mckenna Feb 13 '17 at 20:08
6

Here you could simply use the payload javascript:alert(1), as the auditor doesn't identify javascript URLs within a href attribute as XSS. Clicking the link would execute the code.

However, it will be much harder to execute JS by injecting an additional event handler attribute the way you tried, since your code sample directly reflects the input without additional processing. This is exactly one of the attack scenarios the XSS auditor is meant for. It attempts to identify reflected parts to prevent their execution. As @NickMckenna remarked, there is no general way to bypass the auditor in this scenario.

What you could do is inject other attributes that have side effects. For example, you can still use the style attribute and apply arbitrary CSS (e.g. ' style='background:red;). In combination with other technologies like AngularJS, injecting different attributes can still lead to XSS.


Be aware that the XSS auditor is fragile. Since it has no understanding of how the code is processed on the server side, a simple substitution in a more complex program could be enough to confuse it, e.g.:

<?php
    if (isset($_POST['data'])) { 
        // Filter bad words
        $data = str_replace('BADWORD', '', $_POST['data']);
        echo "<a href='".htmlentities($data)."'>Click Here</a><br/>";
    }
?>

In this case, a sequence like ' onBADWORDmouseover='alert(1) would bypass the auditor.

(Also note that the onerror attribute you tried to inject isn't valid for <a> tags.)

protected by Community Nov 12 '17 at 14:34

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.