XSS in JavaScript

Question

I was recently figuring out thing in a web application and found that the URL is reflected among the source of the page, which make it bit obvious for XSS, but the input from URL which is reflected on source is assigned inside a <script> tag.

URL:

http://www.xyz.com/back?majorID=usdfg&Action=Themesdig&pbPage=vulnerable area&QI.fd_id=random.3232

Code:

<script type="text/javascript">
var _TM = {
    cc : 'RUP'
    ,ll : 'en-US'
    ,mkt : 'IN'
    ,geo : 'IN' 

        ,pagename : 'vulnerable area'
        ,pagetype : 'Custom'
        ,channel : 'Custom'

    }
</script>

So at first moment, I thought an alert('xxx') is enough to create a POC, but inserting alert or anything else is leading the code to become faulty and not renderable and I cannot close the script tag as the application is sanitizing <, > and ' to their HTML representative.

And the webapp is also accepting hex values. I entered Carriage Return %0D (just to confirm they are accepting) and it worked.
So how can I run JavaScript in this situation and create POC?

During these days, I got a near to complete answer ' };alert(13);var misc={a:b, but the only problem is ' at the beginning. There must be some way to overcome with issue too.

Answer 1

So at first moment i thought an alert('xxx') is enough to create a POC but inserting alert or any thing else is leading the code to become faulty

Breaking the code is usually a good sign. A syntax error may show the victim is not performing the correct escapes to keep the code valid. Look at the generated source to see what it produces for your input. If you did just alert('xxx') and the target site failed to encode it at all, you'd get:

    ,pagename : 'alert('xxx')'

which is indeed a syntax error. You would need to (1) escape the context you are being injected into, with a '; (2) tidy up the surrounding context by finishing the var statement, with };; (3) insert your payload; (4) mask the trailing stuff so it doesn't cause any more errors. ie: '};alert('xxx');/*

If the target site does escape ', then look at other characters that are special in the context of a JavaScript string literal. In particular: the backslash, which introduces escape sequences. If the target remembered to escape ' to \', but didn't escape the backslash itself, giving it \' would end up escaping to \\', which is a literal backslash and then a bare quote, ending the string literal and giving you a chance to exploit again.

The other characters that are special in JavaScript string literals are newlines, including Unicode newlines U+2028/U+2029, but there's not usually much you can do with these because they're simply disallowed and break the code. There are times when terminating a piece of code early can be used in an attack, but it's not the simple direct injection we are talking about here.

i thought of inserting bunch of delete hex encode (i.e %127) to delete the pagetype and channel but the webapp is thinking %127 as %12 and failing my second plan also.

127 is decimal not hex. You wanted %7F.

Delete characters don't have special powers in JavaScript or HTML, you wouldn't be able to escape string literal context like that. The delete character would only actually delete preceding characters when typed into a terminal buffer. Terminal codes are a valid attack against apps that drive other console applications by faking user input, but that's not likely something that a web application is ever going to do.

Answer 2

Try inserting

' + alert('xxx') + '

This will render the sourcecode above as

pagename : '' + alert('xxx') + ''

This means in plain English "The value of _TM.pagename is the string which you get when you concatenate an empty string, the return value of calling alert('xxx') and another empty string". To build this string, alert('xxx') will be called.

Because alert doesn't return anything, the pagename will be the string "undefined". Note that this could cause unexpected behavior at a later point in the web application.