Exploiting DOM clobbering to enable XSS

Description

This lab contains a DOM-clobbering vulnerability. The comment functionality allows "safe" HTML. To solve this lab, construct an HTML injection that clobbers a variable and uses XSS to call the alert() function.

Approach

After accessing the lab, I enabled the FoxyProxy extension to proxy all the web requests through BurpSuite. After navigating a bit through the website, I checked BurpSuite's HTTP history.

I noticed the presence of a JavaScript file on the backend: loadCommentsWithDomPurify.js. After checking that file, I saw an interesting line:

let defaultAvatar = window.defaultAvatar || {avatar: '/resources/images/avatarDefault.svg'}

The defaultAvatar object is implemented using a dangerous pattern containing the logical OR operator in conjunction with a global variable. This makes it vulnerable to DOM clobbering.

There is a technique to exploit this misimplementation: I can clobber this object using anchor tags. Creating two anchors with the same ID causes them to be grouped in a DOM collection. The name attribute in the second anchor contains the value "avatar", which will clobber the avatar property with the contents of the href attribute.

In the HTTP history, I also saw domPurify-2.0.15.js, which indicates the use of the DOMPurify filter in an attempt to reduce DOM-based vulnerabilities.

So after this information gathering, I can start working on how to exploit this lab. By clobbering the defaultAvatar object, I can inject an XSS payload that will be passed like this:

{avatar: 'PAYLOAD'}

Then it will be passed to the image source of the comment's avatar:

<img class="avatar" src="Payload">

In this case, a simple payload will look like this:

" onerror="alert(1)//"

The //" at the end are just to comment out the " when it gets passed to the src attribute of the image because there will already be a " to close the src attribute of the image.

But even like that, it won't work because of the URL encoding of the double quotes. After some research, I found out that the cid protocol is allowed by DOMPurify, so I can use it to make my payload work. My payload will now look like this:

<a id=defaultAvatar><a id=defaultAvatar name=avatar href="cid:&quot;onerror=alert(1)//">

I represented the " inside the href so it doesn't get misinterpreted inside the href double quotes.

Now by simply pasting that payload into the comment section and filling the rest of the form and submitting the comment, the defaultAvatar object is clobbered. By posting another comment, the avatar object gets called, and the payload gets placed. The XSS payload gets executed, and the alert box pops up, solving the lab.