I have a question regarding XSS in eval. Normally, eval XSS is pretty straight forward, however this is stumping me.

This particular application takes data from a form field, and put it into the following variable assignment:

var value = eval(form.pymt.value * 12);

Where pymt is the controlled input.

Now, at first I saw this as simple, with multiple methods of execution:

); eval(alert(1));//

Buuuut, this isn't the case. From what I understand, anything that's applied to the form value of pymt is going to be multiplied by 12. However, I'm a little confused, as there have been many occasions where I have been able to comment out trailing code, but this is not the case in this scenario.

I'm wondering why the injected code is not being accepted as anything more than the pymt value as string, and if there is any way around this? Hopefully this question isn't too vague or off topic in any way, and folks can educate me on exactly what's happening.


  • From speaking with coworkers, I've been informed it may have to do with the order of execution of events, starting with the DOM. It sounds like the DOM goes ahead and finishes it's execution by putting the value of pymt into the eval, but then when that's finished, the pymt value is multiplied by 12, then eval'd. Does that make sense? – plast1K Aug 4 '17 at 15:06
  • 1
    Unfortunately nothing except NaN is going to reach the eval stage here unless it is valid to multiply your value by 12. (I'm guessing you can only have a string or a number as form.pymt.value and this is the value under your control.) In order to be anything but NaN your string will have to contain a valid number already, e.g. "1", "-1", "1.34e15". This makes the eval a bit redundant to be honest, unless I'm mistaken (if the intention is to convert a string to a Number the * 12 will accomplish that) – struthersneil Aug 4 '17 at 15:53
  • agree with @struthersneil where eval in this case is redundant as multiplication of integer or float value does not require eval function. XSS can be happen if you having your code in this way, eval(form.pymt.value + "* 12"); – overshadow Aug 4 '17 at 16:09
  • That makes a lot of sense, I appreciate your help in helping me to understand what is going on here. I can have anything as form.pymt.value, but it will always be a string, then converted to int if it's a valid number. – plast1K Aug 4 '17 at 16:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.