1

I am working on a XSS attack and I do not think it's vulnerable after numerous hours of trying. However, a second opinion would be great.

<script language='javascript'>
  var redirecturl = 'mailto:xsss@m0chan.com?mkt_tok=mailtokenhere%3D%3D';
  function redirect() {
    var anchor = window.location.hash;
    window.self.location = redirecturl + anchor;
  }
</script>

My initial attraction to this was the fact that it's passing the value of anchor into window.self.location = redirecturl + anchor;. However I think that using mailto here makes XSS impossible.

3

This is more injection than XSS, but Mailto links have a few features that you can abuse. For example, instead of the email program popping up with just the TO filled out, you can pre-fill the CC, BCC, Subject, and Body. This is done by editing the query string, e.g. ?subject=xyz&cc=other@example.com.

My first thought was that window.location.hash would prevent adding anything to the query string, due to the #. However, I tested it on Chrome, and it seems to be possible.

So using this, somebody malicious could add sneak a few things into the email and hope that it goes unnoticed. For example, the malicious actor could send a blind carbon copy to an account they control:

https://example.com/contact#&bcc=evilminion@example.com

mailto:xss@example.com?mkt_tok=mailtokenhere%3D%3D#&bcc=evilminion@example.com

Or they could insert advertisements:

https://example.com/contact#&body=%0A%0A%0A%0A%0A%0A%0A%0A%0A%0A%0ABuy%20your%20foobar%20cheap%20at%20example.com%2Ffoobar

mailto:xss@example.com?mkt_tok=mailtokenhere%3D%3D#&body=%0A%0A%0A%0A%0A%0A%0A%0A%0A%0A%0ABuy%20your%20foobar%20cheap%20at%20example.com%2Ffoobar

This will still depend on the email client to include these other headers. RFC6068 discourages clients from adding anything beyond "a limited set" of headers that are deemed to be safe, such as subject, keywords, and body.

| improve this answer | |
  • Awesome! Thank you for the prompt descriptive response :) – m0chan Feb 26 at 18:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.