Skip to content

XMLHttp.response source detection depends on sink #294

@TAI-ing

Description

@TAI-ing

I observe that taint flows with XMLHttp.response as source are not detected for each sink.
For example, if sink is document.write taint flow is not recognized.

On the following page, the taint flow XMLHttp.response => document.write is not recognized (XSS vulnerability was verified manually and taint flow is detected with innerHtml and eval as sinks)

<!DOCTYPE html>
<html lang="en">

<head>
    <meta charset="UTF-8">
</head>

<body>
    <h1>Reflected XSS via XMLHttpRequest.response</h1>
    <script>
        var payload = decodeURIComponent(location.hash.substring(1))

        // create a new XMLHttpRequest object
        var xhr = new XMLHttpRequest();
        // localhost URL to send the request to
        var url = payload;
        // open a GET request to the URL
        xhr.open('GET', url, true);
        // set the response type to text
        xhr.responseType = 'text';

        // define what happens on successful data submission
        xhr.onload = function () {
            if (xhr.status >= 200 && xhr.status < 300) {
                console.log('Request successful:', xhr.responseText);

                // taint flow not detected
                document.write(xhr.responseText);
                // taint flow detected
                // document.body.innerHTML = xhr.responseText;
                // taint flow detected
                // eval(xhr.responseText);
            } else {
                console.error('Request failed with status:', xhr.status);
            }
        };

        // send the request
        xhr.send();

    </script>
</body>

</html>

Metadata

Metadata

Assignees

No one assigned

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions