How is a XSS attack possible in this context?

Question

I'm testing a website, which is vulnerable to XSS.

<input type="hidden" id="referer" name="referer" value="INJECTION_POINT">
<script>
  document.referer = referer.value
</script>

• This is the whole context. document.referer is being used nowhere else. (note, that it's referer here and not referrer)

• " is being deleted. There is no vulnerability in the way it gets deleted. There is no encoding possible, and no unicode normalization happening.

Since escaping from the tag or from the attribute value is not possible. You'd have to do something with the value. But as far as I understand it, in this case, I'm not controlling an event, just a variable assignment, for a variable which does not get used anywhere. Is my understanding incorrect?

Answer 1

May be you consider it from the client side only. But XSS injection can be executed also on the backend side.

Suppose you use Velocity to generate HTML. It is valid also for any other engine, but Velocity has exactly the same syntax as your code snippet and we don't need to discuss if $INJECTION_POINT is an abstraction (${INJECTION_POINT} for Thymeleaf, {{ INJECTION_POINT }} for Django, <%= INJECTION_POINT %> for EJS) or if it should be interpreted literally.

Suppose the server application defines the variable as follows:

INJECTION_POINT = "\">\n<script>alert('Hello from XSS!');</script>\n<div/";

Your HTML, before sending it to the client, will be rendered on the server as follows:

<input type="hidden" id="referer" name="referer" value="">
<script>alert('Hello from XSS!');</script>
<div/>
<script>
  document.referer = referer.value
</script>

When browser obtains this code from server, it will execute the malicious code.