I am on a pentest for a client and they have a custom rails app that allows admin accounts to change page contents. While the front end editor filters script tags the backend does not, so using Burp I can get arbitrary JS into the page.

While stored XSS is a mild finding I wanted to see if I could change the page in more meaningful ways like adding <%= %> tags to change the underlying Ruby code. Sadly any input like that has been returned HTML encoded meaning they are filtering it out. I don't think it's a whitelist approach because they will allow junk tags like <s></s>. It seems the filter is finding rouge < characters all alone and any tag with a meaningful character so <# or <?, etc.

Has anyone seen filters like these before and know of any evasion tactics?

  • 2
    I highly doubt the templating engine that Rails uses would allow server side code injection. – multithr3at3d May 21 '18 at 17:02
  • So upon some further research there is a github project for doing exactly that github.com/epinna/tplmap . The thought process I was looking to think through was what kind of filter rules allows javascript but not template code. – staticFlow May 22 '18 at 15:36
  • That looks like it is useful in scenarios where you are able to modify the template source before it reaches the templating engine. The application would have to use templating in an unusual, non-safe way. – multithr3at3d May 22 '18 at 16:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.