1

I have some JS code below that is redirecting to a location taken from a HTML form. Is this vulnerable to an attack like DOM based XSS?

document.theform.reference.onchange = function(){
    var id = document.theform.reference.selectedIndex;
    var url = document.theform.reference[id].value;
    window.location.href = url;
}
  • 3
    The simple answer is: it depends. Depends on a lot of information not present in the question, and is not possible to include in the question. – AviD Jul 31 '15 at 9:59
  • Need any more help with your question? If so I'll update my answer. – SilverlightFox Aug 14 '15 at 18:13
  • hmm! kind a got it, but if you can update, do it..It will be helpful for me :) – Dave Mn Aug 16 '15 at 6:17
5

Yes, it is vulnerable if document.theform.reference[id].value can be a value controlled by another user.

If this value was set to javascript:alert('xss') by an attacker then the line

window.location.href = url;

would cause the script to be executed in the context of the current domain for whichever user is currently using the site.

  • But I assume it also depends on the way it is user controllable. If the user just enters a value in a form from which JS takes it, than I do not see any way an attacker could use that. The user could of course execute JS in his browser by entering javascript:alert() in the form field, but that would mean he is attacking himself. In order for a real XSS vulnerability to exist, I assume an attacker must also be able to somehow send the page to the victim with the url or the form value already populated with the malicious JS. – stanko Jul 30 '15 at 20:06
  • Thanks Silverlight & pineappleman - Since it seems vulnerable to dom xss, if possible pls post how to execute? I need to put payload in form field?! If its self-xss, i tink attacer can exploit via CSRF or Clickjacking, if the page is vulnerable...right? – Dave Mn Jul 31 '15 at 3:28
  • @DaveMn: There's not enough information in your question to see how your form operates and where the form is populated from. – SilverlightFox Jul 31 '15 at 9:04
  • This can also work through url parameter eg like foo.com?parameter_tobe_added_in_document_href=javascript:alert(…. @SilverlightFox thanks a lot – partizanos May 7 at 12:12
0

By looking at the code, I assume that the user is entering the URL parameter into a form.

As @SilverlightFox said, an attacker could enter javascript:alert('xss') in the form, and that would execute the JS, but only in his browser. Since the URL parameter is not part of the URL of the website (either as a GET parameter or somehow else) and is not stored anywhere, I do not see a way an attacker could make another user execute JS code, except convincing him to manually enter the malicious code into the form.

But since XSS is a complicated topic, and I do not have insight in the whole application code, I would still make some precautions.

First, it is important to limit the URLs a user can enter. Hardcode the beginning of the URL, at least the http:// part. That would make sure that nobody can enter a URL with a different protocol like javascript:.

Also, if possible, limit the URLs that can be entered to your domain only. If a user can enter other domains, issue a warning that they are leaving your site.

If you are inserting the url parameter anywhere else in the code, make sure to use the proper output encoding.

0

Yes it is vulnerable to DOM based XSS .You can look at this Wikipedia example to learn how can attacker use this vulnerability gain access on victim's browser.

  • 1
    Without looking at the rest of the application, I wouldn't be so quick to say it's definitely vulnerable. – tangrs Jul 31 '15 at 10:28
  • Yes,you are right. I assumed that executing a script harms the application. – LazyHands Jul 31 '15 at 10:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.