4

Web-site uses jQuery 1.8.3 which has known XSS vulnerability in selector. (https://snyk.io/vuln/npm:jquery:20120206).

It passes filtered and urldecoded document.location.hash (val2 below) value inside selector.

$('div[data-foo=\''+filter(val1)+'\'][data-value=\''+filter(val2)+'\']')

function filter(str) {
    if (str)
        return str.replace(/([ #;?%&,.+*~\':"!^$[\]()=>|\/@])/g,'\\$1');
    return str;
}

I've come up with the following payload:

<img%09src%09onerror=alert`1`%09>

It would work if the equal sign wasn't replaced by \=. Browsers don't seem to tolerate \= at all.

Any ideas how this can be bypassed or maybe another payload that would work here?

UPDATE:

As mentioned here: https://security.stackexchange.com/a/60915/196507

<script defer>alert(2)</script> might work on some browsers (Also I found somewhere that IE is this browser). But unfortunately, it didn't fork for me in IE11 event in simplified form:

document.getElementById('test').innerHTML = "<script defer>alert(1)<\/script>";

UPDATE2:

<script defer> works in IE9, but backticks (`) are not supported there. So problem with escaped parentheses arise.

  • 1
    I will go out on a limb and say this isn't vulnerable as I cannot currently think of any way to bypass that filter. That being said, I will wait a bit before settling on this answer as I would like to see someone prove me wrong. – EdOverflow Jan 12 at 16:58

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.