PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Evading defences using VueJS script gadgets

portswigger.net | research | #xss | #waf-bypass | #csp-bypass | #mutation-xss | #vuejs | #script-gadgets
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

VueJS script gadgets for evading defences: expression-based vectors, event tricks and mutation XSS in the framework, useful for bypassing WAFs and CSP and for developers guarding Vue apps.
Published
Collected

Related coverage

research · portswigger.net
Finding DOM Polyglot XSS in PayPal the Easy Way
Using DOM Invader, PortSwigger found a polyglot DOM XSS in PayPal hidden in CSS-selector handling, then chained unintended script gadgets to bypass the site's CSP after triage dismissed the report.
research · portswigger.net
What's in a tag name? JavaScript, apparently
This research provides technical context that security teams can use for monitoring and validation.
research · portswigger.net
Bypassing WAFs with the phantom $Version cookie
Legacy $Version cookies downgrade parsers into RFC2109 mode, and frameworks — Flask, Django, PHP, Spring — disagree on the result. The discrepancies can be abused to smuggle attacks past WAFs.
research · portswigger.net
Blind CSS Exfiltration: exfiltrate unknown web pages
Blind CSS exfiltration extracts unknown page content when JavaScript is blocked by CSP or DOMPurify, chaining the :has selector and CSS variables into conditional requests that leak data.
research · portswigger.net
Bypassing WAFs and cracking XOR with Hackvertor
Gareth Heyes showcases Hackvertor's tag-based encoding for chaining multiple conversion layers inside Burp requests, demonstrating a Cloudflare WAF bypass and XOR cracking.
research · portswigger.net
When security features collide
James Kettle argues stacked security features can make systems easier to exploit, demonstrating a Cloudflare email obfuscation quirk that bypasses its WAF and all browser XSS filters.
Back