Can you spot the vulnerability? #16022023 — Intigriti

Can you spot the vulnerability? #16022023 — Intigriti

Given Code Snippet:

Code review:

easy-eval.js

if (window.debug) {
    eval(window.debug.toString()); //using eval at DOM element with id "debug"
  //only a and area tag can be used in attack as they are capable of using href attribute. toString get only that attribute
}

easy-xss.js

const pos = document.URL.indexOf('name=') + 5; //user input
const name = document.URL.substring(pos, document.URL.length)// just paring GET parameteres
const container = document.getElementById('container');
container.innerHTML = decodeURI(name); // no proper sanitization

index.html …

bug bounty information security intigriti vulnerability xss-attack xss-vulnerability