PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Finding DOM Polyglot XSS in PayPal the Easy Way

portswigger.net | research | #bug-bounty | #dom-invader | #dom-xss | #csp-bypass | #paypal | #script-gadgets
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Using DOM Invader, PortSwigger found a polyglot DOM XSS in PayPal hidden in CSS-selector handling, then chained unintended script gadgets to bypass the site's CSP after triage dismissed the report.
Published
Collected

Related coverage

research · portswigger.net
Bypassing CSP via DOM clobbering
How to turn HTML injection into a CSP bypass via DOM clobbering: with a gadget like script.src reaching an allowed sink under strict-dynamic, injected scripts can run; DOM Invader can detect it.
research · portswigger.net
Ambushed by AngularJS: a hidden CSP bypass in Piwik PRO
A DOM Invader audit of Piwik PRO uncovered an AngularJS-based debugger whose script gadgets can bypass CSP; with an HTML injection, events like ng-focus could execute code despite the policy.
research · portswigger.net
Evading defences using VueJS script gadgets
VueJS script gadgets for evading defences: expression-based vectors, event tricks and mutation XSS in the framework, useful for bypassing WAFs and CSP and for developers guarding Vue apps.
research · portswigger.net
Bypassing CSP with policy injection
Gareth Heyes injects directives into PayPal's CSP via a token parameter in report-uri, dropping Edge's whole policy with a stray semicolon and overriding Chrome's script-src for a $900 bounty.
blog · portswigger.net
DOM Invader and the case of direct eval vs indirect eval
Gareth Heyes explains why DOM Invader can trigger eval exceptions: direct eval calls can access local scope variables, while indirect eval via a renamed reference runs in global scope and cannot.
blog · portswigger.net
Finding client-side prototype pollution with DOM Invader
DOM Invader has been upgraded to detect client-side prototype pollution (CSPP) in a couple of clicks. The post explains pollution sources, gadgets, and how the tool finds and exploits them.
Back