CAS-002 · Question #711
Which of the following potential vulnerabilities exists in the following code snippet? var myEmail = document.getElementById("formInputEmail").value; if (xmlhttp.readyState==4 &&…
The correct answer is C. DOM-based XSS. The code reads unsanitized user input from the DOM and writes it directly back into the DOM via innerHTML, creating a DOM-based XSS vulnerability entirely within the client-side script.
Question
Which of the following potential vulnerabilities exists in the following code snippet? var myEmail = document.getElementById("formInputEmail").value; if (xmlhttp.readyState==4 && xmlhttp.status==200) { Document.getElementById("profileBox").innerHTML = "Emails will be sent to " + myEmail + xmlhttp.responseText; }
Options
- AJavascript buffer overflow
- BAJAX XHR weaknesses
- CDOM-based XSS
- DJSON weaknesses
How the community answered
(29 responses)- A10% (3)
- B21% (6)
- C66% (19)
- D3% (1)
Why each option
The code reads unsanitized user input from the DOM and writes it directly back into the DOM via innerHTML, creating a DOM-based XSS vulnerability entirely within the client-side script.
JavaScript is a memory-managed language and does not suffer from traditional buffer overflows in the C/C++ sense, making this vulnerability type inapplicable to this code.
The vulnerability is not inherent to the XMLHttpRequest mechanism itself but rather to the unsafe assignment of unvalidated data to innerHTML, regardless of how the data was retrieved.
DOM-based XSS occurs when client-side JavaScript reads attacker-influenced data from the DOM - here via document.getElementById on a form field - and writes it back into the DOM via innerHTML without sanitization. An attacker supplying a crafted email value containing script tags or inline event handlers will have that payload executed in the victim's browser context. This is distinct from reflected or stored XSS because the malicious payload never leaves the client and is never processed by the server.
The code snippet performs no JSON parsing or JSON-specific operations, so JSON-related weaknesses are not relevant here.
Concept tested: DOM-based XSS via unsafe innerHTML assignment
Source: https://owasp.org/www-community/attacks/DOM_Based_XSS
Topics
Community Discussion
No community discussion yet for this question.