Back to home

Reflective XSS via angularJS template injection - Hostinger


Introduction

This is a write-up of an AngularJS Template Injection I found in the main domain of Hostinger. If you don’t know what’s client-side template injection I invite you to take a look at those links [1][2]. Please note that this is my first write-up, I hope you’ll enjoy it.

It all started when @berkanexo was telling me that he got listed on Hostinger Wall Of Fame so I decided to take a look at their website.

What is Hostinger?

A world class web hosting platform. Who has a bug bounty program.

Finding the vulnerability

While browsing their website the first thing I noticed is that they were using AngularJS for the front, I immediately opened the Javascript console to check what version they were using.

angularVersion{:class=“postImage”}

As we can see on the above image, they were using the version 1.5.1. I knew the existance of a payload for that version. The only thing left todo was to check if they were vulenrable to template injection. On the main page of the website was a form to find a unique domain.

findDomainImage{:class=“postImage”}

I inserted the following: toto{ { 4-2 } } and the result was: toto2 which mean they were vulnerable to template injection. It was not enough. I needed to proof that we can run javascript code.

Exploitation

By inserting the following:
{% highlight javascript lineos %} toto{ {x = {‘y’:’’.constructor.prototype}; x[‘y’].charAt=[].join;$eval(‘x=alert(document.domain)’);} } {% endhighlight %} An alertbox should popup and should be accepted as a Proof Of Concept.

Proof of Concept using Chrome:

alertBox{:class=“postImage”}

Proof of Concept using Edge:

alertBox{:class=“postImage”}

Timeline

Thanks for reading.

Tags [ XSS Javascript ]

Contact

Please feel free to ping me on Twitter @tahadraidia or on Mastodon @tahad@infosec.exchange. Also you can find more of my work at https://tahadraidia.com.