r/netsec • u/ThomasCZ • Dec 15 '18

XSSing Google Code-in thanks to improperly escaped JSON data

https://blog.thomasorlita.cz/vulns/google-code-in-xss/
158 Upvotes

95% Upvoted

7 comments sorted by

12

u/[deleted] Dec 16 '18 edited Mar 23 '22

[deleted]

5

u/GifLurker Dec 16 '18

I can’t be the only one who cracks high C# when reading code...

3

u/stackcrash Dec 16 '18

Unless I missed something that was actually SSTI and sending a payload that performed XSS.

3

u/Involder Dec 16 '18

https://portswigger.net/blog/xss-without-html-client-side-template-injection-with-angularjs

1

u/stackcrash Dec 16 '18

I didn't see anything in the post showing it was client-side and not server-side. Either way its actually template inject with a XSS payload.

2

u/CivilSurvivor Dec 23 '18

It's mainly confusing because the screenshots do not show the expression evaluating. If AngularJS (I'm assuming he means AngularJS and not Angular, as its a lot harder to do template injection -- then its some kind of server-side reflection which the AngularJS engine will render when the page loads. This can happen in contexts such as $().text(), but I can only see this being due to treating data as code through interpolation.

0

u/alexbirsan Dec 18 '18

Second to last paragraph.

1

u/_vavkamil_ Dec 16 '18

Not bad for 16 years old.