1

I have been exploring customer support in a website as part of bug bounty program.

I then started a chat with their customer support and pasted the following in the box:

<!--<img src="--><img src=x onerror=javascript:alert(1)//">

Without sending the message. Immediately, I got an alert in the browser.

Is this considered a threat? and how it is possible to impact?

1
  • It might be usable for a Self-XSS attack where an attacker incentivizes the victim to run script within its own browser session. If this could also be used for a DOM-XSS, Reflected-XSS or Stored-XSS is not known from the given observation. If this is covered by the bug bounty program is not known either. Commented Oct 23, 2023 at 4:51

1 Answer 1

1

It depends. The fact that the alert appears before sending means that there's client-side script reading your text input and injecting it into the DOM in some fashion, and doing so insecurely. It is possible for such script to also be sending the "unsent" message to the server, and even displaying it to the representative, potentially also unsafely. You should monitor the network traffic to check. However, likely it isn't going anywhere, and is instead doing something akin to how the question or answer preview function on this site works.

As a side note, it's kind of weird that this works at all. You can only use a javascript URI to execute code in a context where a URI is expected, and onerror (or any other event handler) is not such a context (though src is). The site is presumably doing some funny (and faulty) filtering or modifying of what you typed on the way to the DOM.

If the alert only triggers in your own browser even when you hit Send, then it's "self-XSS" and generally not exploitable. However, if there's a way for an outside to submit such a string into your chat session from another site, then that might be usable as an XSS targeting the person chatting.

If the alert also triggers for the customer support rep (with or without sending), then that can be used for an XSS attack against the customer support rep's session, which could be very serious as such reps often have considerable privileges.

If the alert triggers when viewing a transcript of the chat session (presumably only after sending), and the transcript is on a sensitive domain (one where a victim could have some session that is valuable to compromise), and it is possible to send other people a link to the transcript, then that can be used for stored XSS against other users of the site.

Is this considered a threat?

Usually no. In most cases, "self-XSS" is just not a concern, because it requires the user to attack themselves. There are ways to attempt to socially engineer a user into this - for example, a post online saying something like "Hey, I found a bug in [customer support chat platform]! If you paste [version with actually malicious script] into your chat window, you can see the support rep's screen!" - but that's generally going to be Low likelihood at most.

Some bug bounty programs might pay out some amount anyhow, though (check the program's scope and rules before submitting!), if they are either specifically concerned about such social engineering attacks, or are simply worried that any XSS vector (that doesn't require directly modifying the page source), even self-XSS, indicates a flaw in their anti-XSS protections.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .