Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I found eval() in the JavaScript code of a site in HackerOne.
I could not find the where the function is called, so to test the vulnerability I went to console in Chrome and wrote the method and a JavaScript alert. The alert executed.
The company states that they are not interested in self-XSS. Is eval() considered self-XSS?
Self-XSS means XSS'ing yourself by running things in console, or stored XSS in an area that only affects the user that injected the XSS. Based on your comments it sounds like you've found self-XSS, since in order to exploit it you have to enter browser console commands.
The reason that entering console commands doesn't count as a vulnerability is that every website is vulnerable to that - you don't need code in the page to use eval or anything like that in order to write a malicious payload into the console and run it.
Using eval() in JavaScript code is very risky and could easily lead to XSS vulnerabilities. It's best to not use it at all, and seeing it in production code is certainly a sign that there may be vulnerabilities.
However, just finding the function does not mean that you have found an XSS vulnerability. For the site to be vulnerable, you must somehow manage to pass user input (such as a query parameter, a form field, something you can get saved into the database...) into the function. If you manage to do that, you have found a "real" XSS vulnerability, and not just a "self" one.
If you can only get code to execute from the console, it's not a real PoC and I wouldn't bother reporting it to anyone. If you are writing in the console, you can already execute arbitrary code and you don't need the eval function.
