XSS in script tags application/json - possible?

Question

Is there way to execute alert box if " is not correctly escaped and can be injected in example below?

<script type="application/json">{"requests":{"postClicked":"https://google.com"}</script>

injection:

<script type="application/json">{"requests":{"postClicked":"injection"}here"-alert()-"}</script>

I have tried several ways to break the string, but still failing to execute alert box.

Answer 1

No but maybe.

You cannot directly execute JavaScript inside an application/json script tag, because the browser will not treat anything inside the tag as JavaScript. It is (unfortunately for you) that simple. Unless you can close the script tag and open a new one, there is no direct XSS here.

However injecting JSON data into a page like that is useless by itself. It only happens because the page will read the data from JSON and use it elsewhere. If by chance you can figure out when and where that gets used and find some improper data usage, then you may find a vulnerability yet. For reference here is an example of some vulnerable code with a simple alert demo.

<script type="application/json" id="test">{"title": "<img src=0 onerror=\"alert(1)\">"}</script>

<div id="title"></div>

<script type="text/javascript">
    var data = JSON.parse(document.getElementById('test').innerHTML);
    document.getElementById('title').innerHTML = data['title'];
</script>

Answer 2

If a malicious user controls the string ("https://google.com" in the initial example), it can certainly be broken out of and cause an alert (among other things) with a string like this:

"</script><script>alert()</script>"

Or included in the full example:

<script type="application/json">{"requests":{"postClicked":"</script><script>alert()</script>"}</script>

Roughly speaking, this is what's happening:

• Close the original tag (prematurely)
• Create a new (non-JSON) script tag
• alert()
• Close this newly-created script tag
• Render the leftover "}
• Discard the leftover </script>

Although there are certainly differences between type="application/json" and type="text/javascript", this blog post by Mathias Bynens should offer some more food for thought on the topic.