0

I've found that a user input was passed to jquery selector sink $() This is known to be vulnerable because having something like :

$("<img src='/' onerror=alert('xss');>")

Will result in an alert in the page

But in this case the user input was added to a class selector so the query looks like :

$(.somethingX)

Where X is the user input And because of that when adding something like a tag , it results in an error :

Uncaught Error: Syntax error, unrecognized expression: .someting <img src='/' onerror=alert('xss');>

So the question will be is there a way to bypass that and get xss ? Is appending something to the user input in this case enough to be secure ?

I've also tried to add something like valid class and then add h1:contains('payload') but this will not create the dom element ,because I think it was patched by jquery .

Thanks .

5
  • When you can inject input into a jquery selector, you already are in a JavaScript context. What prevents you from simply writing JavaScript code directly instead of trying to use the HTML document to trigger the code? Let's say the vulnerable code is $('.foo<input here>').bar();. Why not use $('.foo'); alert('XSS'); //').bar();? If there's some specific restriction which prevents this, then you need to mention that in your question.
    – Ja1024
    CommentedAug 25, 2024 at 2:57
  • See also Is XSS possible with jQuery(location.hash)?
    – Sjoerd
    CommentedAug 25, 2024 at 11:09
  • @Ja1024 I interpreted the injection as client-side script running $('.somethingX ' + userinput).
    – Sjoerd
    CommentedAug 25, 2024 at 11:11
  • @Ja1024 It takes the user input into a variable and then do as @Sjoerd said : $('.somethingX ' + userinput) which make it not possible to close the selector and you will get the same error .CommentedAug 25, 2024 at 11:19
  • @Sjoerd the only thing from the link you mentioned is timing attack , is it the only possibility ?CommentedAug 25, 2024 at 11:23

0

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.