Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

XSS in text/javascript Content-Type

Ozgur | Last updated: Mar 23, 2018 12:16PM UTC

Burp scanner reports that on the text/javascript content type, XSS is possible with Severity: High, Confidence: Certain but I didn't find a way to prove it with a PoC. All modern browsers behave text/javascript files not as html file and as a plain text file so the injected malicious javascript doesn't work, just returned as plain text on the web browser. Is there any way to exploit this kind of vulnerabilities? Is it a misinterpretation of scanner?

PortSwigger Agent | Last updated: Mar 23, 2018 01:40PM UTC

Hi Ozgur, Thanks for your message. You are correct that this scenario is not exploitable by itself on modern browsers. I think we're going to update the behavior for this use case, and report such findings as Informational, with the following additional text: As the response is pure JavaScript, no browser will directly execute the injected content. However, this issue may enable an indirect exploit when combined with a link-manipulation vulnerability on the page that imported it. Additionally, it may be useful as a gadget to bypass Content Security Policy, and browser XSS filters. It may take a little while until this is implemented.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.