2

I'm using checkmarx SAST tool and its highlighting jquery selectors using the hash from the URL as Client DOM XSS:

$('[name=' +  location.hash.replace('#', '') + ' ]')

or even

$('#'location.hash.replace('#', ''))

I dont understand how any of the above examples can be vulnerable to XSS given that it has other parts of the selector in it, especially the first one. In my understanding, the only way someone can be vulnerable to XSS via jquery selector is by inserting the hash value without the hash symbol as the following:

$(location.hash.replace('#', ''))

where someone can put something malicious after the hash as https://example.com#<img src="" onerror="alert(1)". Even plain $(location.hash) I think was fixed in the latest releases of jquery.

Please fill me in with whatever I am missing

UPDATE

It turns out that what I thought is the least vulnerable is actually the most. try this $('[name="<img src="" onerror="alert(document.cookie)""]/>') and you'll see the alert popup.

Only jQuery selectors starting with hash or even starting with other selectors but has a hash preceding the injected element will not be exploitable for example this $('.something <img src="" onerror="alert(document.cookie)""]/> #hash') is exploitable, but this $('#hash <img src="" onerror="alert(document.cookie)""]/>') is not.

Can anyone please confirm that my findings are right, and if indeed any hash starting selector can be marked as not exploitable.

shevisi tamid
  • 101
  • 1
  • 11
  • 1
    https://security.stackexchange.com/questions/177261/is-xss-possible-with-jquerylocation-hash – epascarello Jun 07 '22 at 22:06
  • @epascarello, due to my company firewall policy i am unable to view the demo mentioned in that article. but from reading the article (https://web.archive.org/web/20181007101603/https://blog.sheddow.xyz/css-timing-attack/) I still could not understand how that complex css selector would work when preceded with a hash symbol. but even if it is possible, it is very complex to achieve an attack this way since additional vulnerabilities need to exists first, so it should for sure not be marked as a "high" but maybe a "medium". – shevisi tamid Jun 07 '22 at 22:24
  • I do not know what the solution is for that tool to get around the restriction. Does the tool have help pages with each error and explains how to deal with it? – epascarello Jun 08 '22 at 12:23

0 Answers0