Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

DOM Invader - Is this DOM XSS exploitable?

HazZy | Last updated: Apr 29, 2023 06:21PM UTC

Issue:  Cross-site scripting (DOM-based) Severity:  High Confidence:  Firm Burpsuite scan found a potential DOM based XSS. It's on my company's wordpress site using the fluentform plugins. When I inspect element and put in a test payload, hit enter, and start clicking on any radio button on the web page the XSS alert pops up. I am not sure if this is exploitable though. My question is how would you weaponize this? I don't see any parameters to inject, but then again I'm not very good at XSS. Can anyone please point me in the right direction for next steps? I did all the portswigger DOM XSS labs, which helped, but still stuck. Payload I inserted here: <div class="ff-el-input--content"> <input type="text" name="question_3_no" value="<script>alert('XSS')</script>" class="ff-el-form-control" data-name="question_3_no" tabindex="6" id="ff_5_question_3_no"> </div> I search in inspect elements again after triggering the payload, and I see XSS here in addition to the original spot I inserted it above: <p> Unfortunately, based on your response to eligibility screening question(s) <span class="ff_dynamic_value" data-ref="question_1_no" data-fallback="" style="display: none;">1,</span> <span class="ff_dynamic_value" data-ref="question_2_no" data-fallback="" style="display: none;">2,</span> <span class="ff_dynamic_value" data-ref="question_3_no" data-fallback="" style="display: none;"><script>alert('XSS')</script></span> <span class="ff_dynamic_value" data-ref="question_4_no" data-fallback="">4,</span> Please call this ....some more text. </p> DOM Invader says its in two sinks. jQuery.html and element.innerHTML. Here is the stack trace: JQMIGRATE: Migrate is installed, version 3.3.2 -- DOM Invader: Logging stack trace VM2904:1 at Object.grPHz (<anonymous>:2:69672) at _0x10cd5d (<anonymous>:2:178930) at Object.SxUvw (<anonymous>:2:70222) at Object.mkSgm (<anonymous>:2:450798) at Object.SIbeg (<anonymous>:2:459335) at Object.apply (<anonymous>:2:460444) at HTMLSpanElement.<anonymous> (https://api-uat-mirati-and-me.pantheonsite.io/wp-content/plugins/fluentform/public/js/fluentform-advanced.js?ver=4.3.22:1:31508) at Proxy.each (https://api-uat-mirati-and-me.pantheonsite.io/wp-includes/js/jquery/jquery.min.js?ver=3.6.1:2:3003) at l (https://api-uat-mirati-and-me.pantheonsite.io/wp-content/plugins/fluentform/public/js/fluentform-advanced.js?ver=4.3.22:1:30975) at HTMLInputElement.<anonymous> (https://api-uat-mirati-and-me.pantheonsite.io/wp-content/plugins/fluentform/public/js/fluentform-advanced.js?ver=4.3.22:1:30890) at HTMLFormElement.dispatch (https://api-uat-mirati-and-me.pantheonsite.io/wp-includes/js/jquery/jquery.min.js?ver=3.6.1:2:43064) at y.handle (https://api-uat-mirati-and-me.pantheonsite.io/wp-includes/js/jquery/jquery.min.js?ver=3.6.1:2:41048) VM2905:1 -- DOM Invader: Logging stack trace VM2905:1 at Object.iczDz (<anonymous>:2:76995) at _0x5d4cbc (<anonymous>:2:578016) at Object.ICRmq (<anonymous>:2:144220) at Object.THqFs (<anonymous>:2:324551) at HTMLSpanElement.set [as innerHTML] (<anonymous>:2:438849) at s.fn.init.<anonymous> (https://api-uat-mirati-and-me.pantheonsite.io/wp-includes/js/jquery/jquery.min.js?ver=3.6.1:2:50784) at B (https://api-uat-mirati-and-me.pantheonsite.io/wp-includes/js/jquery/jquery.min.js?ver=3.6.1:2:32425) at s.fn.init.html (https://api-uat-mirati-and-me.pantheonsite.io/wp-includes/js/jquery/jquery.min.js?ver=3.6.1:2:50497) at Object.apply (<anonymous>:2:460609) at HTMLSpanElement.<anonymous> (https://api-uat-mirati-and-me.pantheonsite.io/wp-content/plugins/fluentform/public/js/fluentform-advanced.js?ver=4.3.22:1:31508) at Proxy.each (https://api-uat-mirati-and-me.pantheonsite.io/wp-includes/js/jquery/jquery.min.js?ver=3.6.1:2:3003) at l (https://api-uat-mirati-and-me.pantheonsite.io/wp-content/plugins/fluentform/public/js/fluentform-advanced.js?ver=4.3.22:1:30975) at HTMLInputElement.<anonymous> (https://api-uat-mirati-and-me.pantheonsite.io/wp-content/plugins/fluentform/public/js/fluentform-advanced.js?ver=4.3.22:1:30890) at HTMLFormElement.dispatch (https://api-uat-mirati-and-me.pantheonsite.io/wp-includes/js/jquery/jquery.min.js?ver=3.6.1:2:43064) at y.handle (https://api-uat-mirati-and-me.pantheonsite.io/wp-includes/js/jquery/jquery.min.js?ver=3.6.1:2:41048)

Hannah, PortSwigger Agent | Last updated: May 04, 2023 08:57AM UTC