XSSAuditor bypass via “location.search”

Anastasios Stasinopoulos — Sat, 06 Sep 2014 11:13:10 +0000

As it has already been mentioned in a previous post, one of the most widely used instances in JavaScript is the Location Object which is used to determine the current URL.

In this example, we will focus on search property of location object which, sets or returns the query string part of a URL.

In this article we have tried to bypass XSSAuditor using location.search property. The XSSAuditor in Google Chrome (Version 37.0.2062.94 – Linux / Version 37.0.2062.103 m – Windows) and in Google Chromium (Version 35.0.1916.153 Built – Linux) was found vulnerable to a DOM-based XSS attack, when the user’s input (the attack vector) went through the location.search property and then was written to the page’s DOM by using the document.write method.

The problem

The problem we faced here was that of the location.search property. More specifically, the location.search property printed back an encoded representation of the query string part of a URL causing the attack to fail.

That’s why we used the decodeURI() function to enclose the location.search property. The decodeURI() function replaces each escape sequence (in the encoded URI) with the character that it represents.

The weakness

Thus, to prove this weakness we make use of the following simple example “location_search_XSS.html”.

The Attack

In order to exploit the above weakness, we could use the same attack vector as in previous post (without svg closing tag)

?

During the execution of the following on the browser’s URL, the page takes the attack vector as an unescaped input from decodeURI(window.location.search) property and overwrites it to the page’s DOM by using the document.write method.

file:///home/ancst/Desktop/location_href_XSS.html?

After executing the above, this is the situation inside DOM.

XSSAuditor bypass via “location.href”

Anastasios Stasinopoulos — Fri, 05 Sep 2014 10:01:33 +0000

Nowadays, one of the most widely used instances in JavaScript is the Location Object which is used to determine the current URL.

The location object is part of the Window Object which represents an open window in a browser and is accessed through the window.location property.

The location object has these properties:

It is worth noting that in this example, we will focus on href property which, as mentioned in the above table, sets or returns the entire URL of the current page.

Back in 2011 a report from Simone Onofri was sent to Chromium security team, concerning an XSS vulnerability, which was referring to an XSSAuditor’s filter bypass through the use of location.href. Currently, this appears to be fixed.

In this article we have tried to bypass XSSAuditor using (the same) location.href property. The XSSAuditor in Google Chrome (Version 37.0.2062.94 – Linux / Version 37.0.2062.103 m – Windows) and in Google Chromium (Version 35.0.1916.153 Built – Linux) was found vulnerable to a DOM-based XSS attack, when the user’s input (in our case, the attack vector) went through the location.href property and then was written to the page’s DOM by using the document.write method.

The weakness

In order to prove this weakness we make use of the following simple example “location_href_XSS.html”.

The Attack

In order to exploit the above weakness, we could use the following attack vector (without svg closing tag)

#

During the execution of the following link on the browser’s URL, the page takes the attack vector as an input from location.href property and writes it to the page’s DOM by using the document.write method.

file:///home/ancst/Desktop/location_href_XSS.html#

After executing the above, this is the situation inside DOM.

javascript – pwnopticon

XSSAuditor bypass via “location.search”

The problem

The weakness

The Attack

XSSAuditor bypass via “location.href”

The weakness

The Attack