4

Web-site uses jQuery 1.8.3 which has known XSS vulnerability in selector. (https://snyk.io/vuln/npm:jquery:20120206).

It passes filtered and urldecoded document.location.hash (val2 below) value inside selector.

$('div[data-foo=\''+filter(val1)+'\'][data-value=\''+filter(val2)+'\']')

function filter(str) {
    if (str)
        return str.replace(/([ #;?%&,.+*~\':"!^$[\]()=>|\/@])/g,'\\$1');
    return str;
}

I've come up with the following payload:

<img%09src%09onerror=alert`1`%09>

It would work if the equal sign wasn't replaced by \=. Browsers don't seem to tolerate \= at all.

Any ideas how this can be bypassed or maybe another payload that would work here?

UPDATE:

As mentioned here: https://security.stackexchange.com/a/60915/196507

<script defer>alert(2)</script> might work on some browsers (Also I found somewhere that IE is this browser). But unfortunately, it didn't fork for me in IE11 event in simplified form:

document.getElementById('test').innerHTML = "<script defer>alert(1)<\/script>";

UPDATE2:

<script defer> works in IE9, but backticks (`) are not supported there. So problem with escaped parentheses arise.

  • 1
    I will go out on a limb and say this isn't vulnerable as I cannot currently think of any way to bypass that filter. That being said, I will wait a bit before settling on this answer as I would like to see someone prove me wrong. – EdOverflow Jan 12 at 16:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.