I think this code may be vulnerable to dom based xss but i wasn't able to get an alert box. I am able to control the userTitle field, i tried using </script> but it get changed to u003c/scriptu003e so i think the only option is to insert valid js code that will trigger an alert box as the other chars like " and ' are not escaped. Which code should i use to trigger an alert box?

The affected code is the following:

window.GD.page = window.GD.page || {};
$.extend(GD.page, {"mixpanelProps":{"userTitle":"XSS- 
  • You can try with ;alert(1) – Tryna Learn Somethin Feb 10 '19 at 14:57
  • @Tryna Learn Somethin, I already tried with A";confirm(1) or similar js but it doesn't seems to work. In addition, alert is filter and get rendered as alert[1) – Pringles Typer Feb 10 '19 at 15:12
  • @PringlesTyper please use the same account to update your question – schroeder Feb 10 '19 at 15:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.