PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Bypassing DOMPurify again with mutation XSS

portswigger.net | research | #firefox | #web-security | #chrome | #dompurify | #mutation-xss | #sanitizer-bypass
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A fresh mutation XSS bypass of DOMPurify's patch: crafted comments and encoded tags mutate sanitized markup into executable XSS in Chrome, plus a CDATA variant for Firefox; fixed in DOMPurify 2.1.
Published
Collected

Related coverage

research · portswigger.net
Bypassing Firefox's HTML Sanitizer API
Gareth Heyes bypassed Firefox's HTML Sanitizer API: SVG 'use' elements importing same-origin absolute URLs still executed JavaScript, even for uploads protected with Content-Disposition: attachment.
blog · netlas.io
Netlas Chrome and Firefox Extensions
Walks through installing and using the Netlas extension for Chrome and Firefox: store setup, connecting an API key, and manual versus automatic (Smart Logo) vulnerability-detection modes.
research · portswigger.net
Concealing payloads in URL credentials
Payloads concealed in URL credentials stay invisible in Chrome and Firefox address bars, persisting through same-origin navigation; document.URL exposes them, enabling DOM XSS and clobbering.
research · portswigger.net
Evading defences using VueJS script gadgets
VueJS script gadgets for evading defences: expression-based vectors, event tricks and mutation XSS in the framework, useful for bypassing WAFs and CSP and for developers guarding Vue apps.
research · portswigger.net
Framing without iframes
Chrome allows framing sites via param tags inside object and embed's code attribute; Firefox now matches Chrome's tabindex onfocus behaviour. Vectors documented in the XSS cheat sheet.
research · portswigger.net
XSS in hidden input fields
Gareth Heyes shows how to execute XSS inside hidden input fields: Firefox fires onclick when an access key activates the element. Includes the PoC vector and key combinations.
Back