GoCD · Report #2419227
XSS in new.loading.page.html
Summary
Exploiting a vulnerability rooted in inadequate handling of query parameters within the new.loading.page.html file, attackers can manipulate the URL query to insert javascript: URIs. By triggering the redirectToLanding function with a crafted URL parameter like ?redirect_to=javascript:alert("XSS"), the vulnerable code executes the injected script, leading to Cross-Site Scripting (XSS) exploitation.
How it was found
Overview
The vulnerability arises from inadequate handling of query parameters, enabling attackers to insert javascript: URIs as redirectors within the new.loading.page.html file.
var redirectToLanding = function() {
var locationData = window.location.search.match(/(\?|&)redirect_to=([^&]+)(&|$)/);
if (locationData === null) {
window.location.reload(true);
} else {
window.location = decodeURIComponent(locationData[2]);
}
}
When the URL's query is ?redirect_to=javascript:alert("XSS"), locationData[2] equals 'javascript:alert("XSS")'. Subsequently, triggering redirectToLanding leads to XSS exploitation.
Impact
Attackers can inject javascript: URIs to execute unauthorized scripts, potentially stealing sensitive information such as session cookies or performing actions on behalf of the user.