FirstBlood-#544 — Reflected XSS on /register.php using ref parameter
This issue was discovered on FirstBlood v2
On 2021-10-26, th33phoenix Level 4 reported:
Hey there!!!!
While testing on First Blood v2.0.0 I found a Reflected XSS in register.php page.
Description:
The /register.php page has a hidden parameter "ref" that can be used to inject malicious XSS payload into the page. Though the previous bug has been fixed at the end point, using another bypass, it is still possible to inject XSS payloads
Impact:
Using a phishing attack, an attacker can enable a victim to visit the /register page, injecting malicious payload into the victim browser, stealing his credentials, cookies, etc
Browser used:
Firefox 93.0
Steps to reproduce:
- While running Param Miner ( a Burp suite extension used to find hidden parameters) on /register.php page, found a hidden parameter ref
![](png/cuxmnqfud7xpyoqpa7rk.png)
- Go to /register.php and inject ?ref= parameter in the url and intercept the request. See that the ref parameter value is reflected in the response:
![](png/drebhedl3fnrkun3npfv.png)
- Try closing the anchor tag and inject a script tag. <, > , script are being blocked:
![](png/a5idd65yax1fvtbq94tu.png)
- Since the value is reflected in href, try injecting javascript:alert(1)
![](png/ybogcdjvx3fjaqflhpur.png)
See that the word "javascript" is blocked.
- Try inputting the words "jav" and "java". See that the end point accepts "jav" but blocks "java" :
![](png/bo2rjhsrdm3hhcc2cdbp.png)
![](png/sbkumey71ld9putxcrpn.png)
-
Bypass this using the following payload: jav%0aa
-
Also, observe that the word "script" is blocked but "scrip" is accepted. So use this payload to input the word "javascript"
jav%0aascrip%0at
So the final payload will be
jav%0aascrip%0at:alert(1)
- Go to the browser and inject the above payload in the ref parameter:
![](png/r1c7q0ivtd6imonqlwxo.png)
- Click on the "Return to previous page" and see that the payload is executed:
![](png/mpkdryon075bdda5p7kd.png)
P3 Medium
Endpoint: /register.php
Parameter: ref
Payload: jav%0aascrip%0at:alert(1)
FirstBlood ID: 32
Vulnerability Type: Reflective XSS
The parameter ?ref on register.php was poorly fixed and can be bypassed in various ways. Firstly the developer failed to use strtolower() when comparing strings, and the use of characters such as
%09
will also bypass the filter.