DOM XSS Angular JS Expression-PostSwigger Lab Walthrough

Introduction

In this blog, we will explore DOM- based Cross-SIte Scripting (XSS) in Angular JS using a PotSwigger lab. This vulnerability allows an attacker to execute JavaScript code by injecting an expression within an Angular JS directive.

Understanding the Vulnerability

1. Angular JS expressions are enclosed in {{ }} and get evaluted dynamically.

2. When user input is inserted into an AngularJS expression, it may allow malicious JavaScript execution.

3. This lab demonstrates a case where angle brackets (< >) and double quotes (“ “) are HTML-encoded, but AngularJS expressions can still be exploited.

Identifying the Vulnerability

1. The search functionality processes user input within an AngularJS expression.

2. Since {{ }} can be used to execute JavaScript, we can attempt an attack.

Crafting the Payload

To exploit this, inject the following payload:

{{constructor.constructor(‘alert(1)’)()}}

Explanation:

1. constructor.constructor allows us to execute JavaScript functions dynamically.

2. alert(1) triggers a popup, proving XSS exists.

Executing the Payload

1. Enter the payload into the search box (or relevant input field).

2. Submit the form and observe if the JavaScript executes.

3. If successful, ana alert box will pop up.

Mitigation

1. Disable AngularJS expressions where not needed.

2. Use Content Security Policy (CSP) to block inline scripts.

3. Escape user input properly to prevent execution.

Conclusion

1. This lab demonstrates how DOM-based XSS can occur in AngularJS expressions.

2. User input should never be trusted when injected into the DOM without sanitization.

3. Always follow secure coding practices to prevent XSS vulnerabilities.