2

An application has the following javascript code which is triggered whenever an user tries to upload a file.

a.html(fileName)

then if the user uploads a file named <img src=x onerror=alert()> the javascript code is executed.

Does this qualify as a Low-severity DOM-XSS? I mean, usually I see DOM-XSS which exploit URL giving more strength to the attack. In this case I should trick a user to upload a file with a specific name, so it's like a self-xss. Also, I couldn't find a cve for this kind of DOM-XSS.

Improve this question
2
  • it's much easier to use devtools to run code client-side. I don't see how this could inadvertently jeopardize a real user in the real world. FWIF, you should use a.text(fileName) to avoid such XSS.
    – dandavis
    Jul 19, 2021 at 20:08
  • Triggered via onchange of value attribute would be a little more insecure. .. more secure if the filename comes from a resource URL or event.files... since you should know the user has selected a file at that point instead of XSS changing the input's value.
    – pcalkins
    Aug 30 at 18:51

1 Answer 1

Reset to default
0

In my opinion, yes, this is a low to very low severity example of XSS. User-controlled input is rendered insecurely.

The fact that this requires a user to upload a specially crafted file, reduces the likelihood of abuse, not the impact.

People are the weakest link in cybersecurity. They can be tricked into uploading any file.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .