Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Potential False Positive DOM Based XSS

Ozgur | Last updated: Apr 03, 2018 04:23PM UTC

Hi, Burp reported just this below line as Dom Based XSS vulnerability as Severity: High, Confidence: Tentative. I didn't find a way to exploit this line within a scenario since there is no parameter exists that can be user controllable. When I debug from console currentURL parameter, only real location of url is returned. How can this type of XSS vuln can be exploited, or is it a false positive? var currentURL = $(location).attr('href'); Best regards, Ozgur

PortSwigger Agent | Last updated: Apr 04, 2018 09:27AM UTC

Hi Ozgur, Thanks for your message. Whether this is exploitable depends on the JavaScript framework and version in use. If this is jQuery, it is not exploitable in 1.6.3 or newer: - https://blog.jquery.com/2011/09/01/jquery-1-6-3-released/ If this is older jQuery, an attacker can introduce script like this: - http://legitimate.url/path#<script>alert(1)</script>

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.