9

Web-site uses jQuery 1.8.3 which has known XSS vulnerability in selector. (https://snyk.io/vuln/npm:jquery:20120206).

It passes filtered and urldecoded document.location.hash (val2 below) value inside selector.

$('div[data-foo=\''+filter(val1)+'\'][data-value=\''+filter(val2)+'\']')

function filter(str) {
    if (str)
        return str.replace(/([ #;?%&,.+*~\':"!^$[\]()=>|\/@])/g,'\\$1');
    return str;
}

I've come up with the following payload:

<img%09src%09onerror=alert`1`%09>

It would work if the equal sign wasn't replaced by \=. Browsers don't seem to tolerate \= at all.

Any ideas how this can be bypassed or maybe another payload that would work here?

UPDATE:

As mentioned here: https://security.stackexchange.com/a/60915/196507

<script defer>alert(2)</script> might work on some browsers (Also I found somewhere that IE is this browser). But unfortunately, it didn't fork for me in IE11 event in simplified form:

document.getElementById('test').innerHTML = "<script defer>alert(1)<\/script>";

UPDATE2:

<script defer> works in IE9, but backticks (`) are not supported there. So problem with escaped parentheses arise.

  • 1
    I will go out on a limb and say this isn't vulnerable as I cannot currently think of any way to bypass that filter. That being said, I will wait a bit before settling on this answer as I would like to see someone prove me wrong. – EdOverflow Jan 12 '19 at 16:58
1

You would maybe be able to do it if the charset was not atypical, and then you may be able to get a valid result by using a multibyte character converting into an equals sign, but you can't change the charset yourself as it will probably appear in the server response header, or default to UTF-8.

In Section 12.1.2.1-3 of the HTML standards, tags have to be closed by U+003E so using script tags will not work. Attributes can be specified by an empty syntax, such as 'disabled', but none of these will allow you to execute JavaScript. You can use unquoted value syntax, as you've pointed out in your question, but the unquoted part must follow a U+003D sign, as it does for single or double quoted attributes, meaning there's no avenue left to exploit.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.