XSS in a variable assignment when <>" are escaped

Question

SCENARIO:

user input is reflected inside a variable. For example

url.com/?a=hello

is reflected as shown below

var test="hello";

I tried to evade from the variable with payload like hello"; or hello%22; or hello%2522; but unsuccessfully. All these characters are reflected without encoding: .[]{};:{}\/?|_-+ so i can use them

Is there another way to exploit this situation?

Answer 1

No, not given the filter behavior you specified.

• You need double quotes (") to exit the JS string context.

• You need angle brackets (<>) to exit the <script> tag which I presume surrounds the code.

• You can use a backslash (\) at the end of the string to escape the closing quote, however you'd need another injection point on the same line to do anything useful with that. Otherwise you're unable to close the string you've now kept open, and the JS parser will throw a syntax error, implying it does not execute any part of the script.

  Here is how an attack would work with two injection points.

  Code:

  var test="hello"; var test2="stranger";
  

  Vectors:

            \                  ;alert()//
  

  Result:

  var test="\"; var test2=";alert()//";
           |--------------|        |--|
         one continuous string    comment