XSS attack on websites that allows JS file upload?

Question

Consider a website example.com that allows users to upload arbitrary JS files, that are then stored on the server and served to visitors with a JS content type. Could an attacker use this to perform an XSS attack on example.com?

At first, I thought the answer was an obvious yes. But thinking about it, it is not obvious how one would do this? If you just point the victim to the URL of an uploaded JS file, the browser will download and display the code, not execute it. Unless there is some other vulnerability, the attacker can't upload HTML files or force existing HTML files to include the script. Including it on evil.com will not help since it will then not be running in the example.com origin.

I know there are plenty of security issues with file upload, but here I am only interested in the potential for XSS if you allow upload of JS.

Answer 1

That depends on whether or not the website allows file inclusion via URLs, or if the site persists some JavaScript to run again later.

About Remote File Inclusion

Imagine the website has a feature where you can link to some external JavaScript file and run that. If this can be done via a link, e.g. via example.com?src=evil.com/mal.js, then this is a reflected XSS vulnerability.

The ability of the application to interactively load remote JavaScript is not enough. It needs to be done via an URL, so that the only thing the victim has to do is click the URL.

About Persistence

If the website allows users to run JavaScript that others have created, then you may have a stored XSS vulnerability, but it depends on how the site is structured. For example, if you visit example.com/mallory/mal/ and the website asks you if you are sure you want to run mal.js by Mallory and warning about the risks of running untrusted code, then you should be fine. If the website however just runs it, then I would classify this as stored XSS.

About Social Engineering

One might argue that it's a case of self-XSS, where an attacker could social engineer a person into downloading a malicious JS file and running it on your website. While this is a legitimate concern, I would not consider this a huge vulnerability. You could mitigate this risk somewhat by displaying a warning, though users may click that away.