1

I have some JS code below that is redirecting to a location taken from a HTML form. Is this vulnerable to an attack like DOM based XSS?

document.theform.reference.onchange = function(){
    var id = document.theform.reference.selectedIndex;
    var url = document.theform.reference[id].value;
    window.location.href = url;
}
Improve this question
1
  • 3
    The simple answer is: it depends. Depends on a lot of information not present in the question, and is not possible to include in the question.
    – AviD ♦
    Jul 31, 2015 at 9:59

2 Answers 2

Reset to default
5

Yes, it is vulnerable if document.theform.reference[id].value can be a value controlled by another user.

If this value was set to javascript:alert('xss') by an attacker then the line

window.location.href = url;

would cause the script to be executed in the context of the current domain for whichever user is currently using the site.

Improve this answer
4
  • But I assume it also depends on the way it is user controllable. If the user just enters a value in a form from which JS takes it, than I do not see any way an attacker could use that. The user could of course execute JS in his browser by entering javascript:alert() in the form field, but that would mean he is attacking himself. In order for a real XSS vulnerability to exist, I assume an attacker must also be able to somehow send the page to the victim with the url or the form value already populated with the malicious JS.
    – pineappleman
    Jul 30, 2015 at 20:06
  • Thanks Silverlight & pineappleman - Since it seems vulnerable to dom xss, if possible pls post how to execute? I need to put payload in form field?! If its self-xss, i tink attacer can exploit via CSRF or Clickjacking, if the page is vulnerable...right?
    – Dave Mn
    Jul 31, 2015 at 3:28
  • @DaveMn: There's not enough information in your question to see how your form operates and where the form is populated from.
    – SilverlightFox
    Jul 31, 2015 at 9:04
  • This can also work through url parameter eg like foo.com?parameter_tobe_added_in_document_href=javascript:alert(…. @SilverlightFox thanks a lot
    – partizanos
    May 7, 2019 at 12:12
0

By looking at the code, I assume that the user is entering the URL parameter into a form.

As @SilverlightFox said, an attacker could enter javascript:alert('xss') in the form, and that would execute the JS, but only in his browser. Since the URL parameter is not part of the URL of the website (either as a GET parameter or somehow else) and is not stored anywhere, I do not see a way an attacker could make another user execute JS code, except convincing him to manually enter the malicious code into the form.

But since XSS is a complicated topic, and I do not have insight in the whole application code, I would still make some precautions.

First, it is important to limit the URLs a user can enter. Hardcode the beginning of the URL, at least the http:// part. That would make sure that nobody can enter a URL with a different protocol like javascript:.

Also, if possible, limit the URLs that can be entered to your domain only. If a user can enter other domains, issue a warning that they are leaving your site.

If you are inserting the url parameter anywhere else in the code, make sure to use the proper output encoding.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .