1

I was testing example.com and i found a js reflection point. If i send the following request:

https://example.com/?token=test%22test="'-confirm(1)-'

I can see the following in server response:

<script nonce="">
window.meta    = {
"token": "Token\"xss=\"'-confirm(1)-'",
"dToken": "dt\"xss=\"'-confirm(1)-'",
"Id": "11"
</script>

Is this code vulnerable to Dom Based XSS? If yes, which payload could i try to trigger an alert box?

I already tried to close the </script> tag but < and > are filtered.

Improve this question
  • What does it do with a backslash? Also, your URL and server response don't seem to quite match. Any chance you have a mistake in your question? – Conor Mancone Nov 23 '19 at 2:36
3

No it's not vulnerable to XSS based on the provided information. The interpolated URL query parameter token has quote marks escaped (\" instead of just ") so you cannot break out of the string. Because of this it is impossible to inject executable code, opposed to simply changing the content of a JavaScript string variable.

As you pointed out, it is also impossible to close/reopen the script tag.

As noted in the comments, if backslashes are not escaped (which we don't know), you can use an additional \ to escape the first backslash of \" so that it becomes \\" in which case you can break out of the string because the " character is now no longer escaped.

Improve this answer
  • If it doesn't escape backslashes then it is vulnerable despite escaping the double quote – Conor Mancone Nov 23 '19 at 2:37
  • @ConorMancone, If i insert a single backslash it prints \\\"xss=\"'-confirm(1)-'", – Pong Nov 26 '19 at 22:38
  • @Pong if it is escaping backslashes and quotes then it sounds like it is not vulnerable. If they didn't escape the backslash then you could add a backslash before the one that escapes the double quote, turning it into a literal backslash and breaking out – Conor Mancone Nov 27 '19 at 0:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.