I've recently tested a web application and found out that it was vulnerable to Stored XSS attacks. However, a peculiar behavior left me a bit puzzled. When I inserted
John <script>alert(1)</script>Doe, my browser showed that the script tag was indeed injected correctly, but the alert did not pop up.
John <img src=x onerror=alert(1)>Doe, the alert popped up immediately upon load.
What I ruled out so far
- Escaping: I thought perhaps the
<script>tags were escaped, and yet for some reason not rendered, but my proxy confirmed that the tags were not escaped.
- CSP: It occurred to me that a CSP might be in place, but there was none, and also if it had blocked an injected
<script>tag, it would also have blocked an injected
<img>tag as well.