XSS with escaped equal sign inside jQuery selector

Question

Web-site uses jQuery 1.8.3 which has known XSS vulnerability in selector. (https://snyk.io/vuln/npm:jquery:20120206).

It passes filtered and urldecoded document.location.hash (val2 below) value inside selector.

$('div[data-foo=\''+filter(val1)+'\'][data-value=\''+filter(val2)+'\']')

function filter(str) {
    if (str)
        return str.replace(/([ #;?%&,.+*~\':"!^$[\]()=>|\/@])/g,'\\$1');
    return str;
}

I've come up with the following payload:

<img%09src%09onerror=alert`1`%09>

It would work if the equal sign wasn't replaced by \=. Browsers don't seem to tolerate \= at all.

Any ideas how this can be bypassed or maybe another payload that would work here?

UPDATE:

As mentioned here: https://security.stackexchange.com/a/60915/196507

<script defer>alert(2)</script> might work on some browsers (Also I found somewhere that IE is this browser). But unfortunately, it didn't fork for me in IE11 event in simplified form:

document.getElementById('test').innerHTML = "<script defer>alert(1)<\/script>";

UPDATE2:

<script defer> works in IE9, but backticks (`) are not supported there. So problem with escaped parentheses arise.

Answer 1

You would maybe be able to do it if the charset was not atypical, and then you may be able to get a valid result by using a multibyte character converting into an equals sign, but you can't change the charset yourself as it will probably appear in the server response header, or default to UTF-8.

In Section 12.1.2.1-3 of the HTML standards, tags have to be closed by U+003E so using script tags will not work. Attributes can be specified by an empty syntax, such as 'disabled', but none of these will allow you to execute JavaScript. You can use unquoted value syntax, as you've pointed out in your question, but the unquoted part must follow a U+003D sign, as it does for single or double quoted attributes, meaning there's no avenue left to exploit.