17

Suppose only user-supplied double quotes are allowed in an input tag which has the style attribute set to display: none.

Something like this:

<input type="text" style="display: none;" value="aa" autofocus/onfocus="prompt(1)">

Since the injection point is behind the style attribute, is it still possible to get XSS by triggering an event handler?

  • 3
    Where exactly is the injection point, the value attribute? And what do you mean by "user-supplied"? – Bergi Apr 2 '18 at 18:45
14

You can always use the same approach which may be used for hidden input, but this requires quite a bit of social engineering as it's difficult to trigger.

You can however use a different event attribute which may be easier to trigger. oninvalid comes to mind as it doesn't require the element to be shown:

<form>
<input type="text" style="display: none;" value="aa" oninvalid="alert(1)" pattern="b">
<input type="submit" value="Submit">
</form>
  • 1
    I wasn't able to use the accesskey technique with a display:none field (in FF). Are you sure it works here? – Arminius Apr 2 '18 at 13:29
  • 1
    @Arminius Yes, I tested it with a current version of FF and it worked. Odd that it doesn't work for you; I have no idea why that might be. But I don't think it matters much, because the oninvalid method is actually superior. – tim Apr 2 '18 at 13:33
  • Do you mind comparing these fiddles and see if accesskey triggers for you in both? jsfiddle.net/81sccuqx jsfiddle.net/50z3q749 That aside, the oninvalid trick is great. – Arminius Apr 2 '18 at 13:40
  • 3
    @Arminius No, just in the second. I think that I see the problem now though. I'm using onclick, not onfocus: <input style="display: none;" accesskey="X" onclick="alert(2)">. – tim Apr 2 '18 at 13:45
  • 1
    onclick can fire for hidden elements if the corresponding <label> is clicked. It may be possible to make another form element’s label trigger it by setting the id attribute. – Brian Nickel Apr 3 '18 at 4:37
3

Similar to what was mentioned with accesskey, you can get onclick to fire for hidden elements using label elements.

When you click on <label for="some-id">, the browser will look for the first input with that element and perform a click, even if hidden. A legitimate use-case for this feature is checkbox/radio inputs where the label is being used to indicate state, like the frequency selectors on this site's email settings page.

Imagine you had a form that looked like this:

<input type="text" style="display:none" value="" onclick="alert(1)">
<label for="field">Name</label>
<input type="text" id="field">

The value, " id="field would result in a page looking like this:

<input type="text" style="display:none" value="" id="field" onclick="alert(1)">
<label for="field">Name</label>
<input type="text" id="field">

You will get an alert if the user clicks "Name". How often users click on the label will depend on a lot of things but some site designs may require clicking a label to accomplish a given task.

This is also heavily dependent on page ordering. The placement of the hidden input relative to the legitimate input matters, as well as whether the hidden input has an id and where it is relative to the value.

  • It means that I have to inject <label for="field">Name</label> <input type="text" id="field"> these things also, But I can't close the input tag. – Utkarsh Agrawal Apr 6 '18 at 10:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.