Disclaimer

This testing was conducted strictly for educational and security research purposes. I do not support or encourage testing on systems without proper authorization. Always ensure you have explicit permission before performing any security testing on live environments.

Summary

A search functionality within the application improperly handles user-supplied input by directly reflecting it into the HTML response without adequate sanitization or encoding.

This behavior allows execution of arbitrary JavaScript, leading to Reflected Cross-Site Scripting (XSS) and DOM-based XSS.

Additionally, crafted inputs reveal backend processing behavior and internal infrastructure details. While attempts to escalate into Server-Side Request Forgery (SSRF), Command Injection, and Server-Side Template Injection (SSTI) were unsuccessful, the application still exposes internal execution flow and system-level information.

Impact

• Arbitrary JavaScript execution in victim’s browser
• Session hijacking and account takeover potential
• Credential harvesting and phishing attacks
• Client-side request manipulation
• Internal infrastructure disclosure aiding further attacks

Proof of Concept

1. HTML Injection (Initial Validation)

<h1>Hiii</h1>

Explanation: The payload is rendered directly in the response, confirming that user input is not encoded. This indicates a lack of output sanitization and establishes a baseline for further injection.

2. Reflected Cross-Site Scripting

<script>alert("XSS Works?")</script>

Explanation: The injected script executes successfully in the browser. This confirms that arbitrary JavaScript can run within the application context, affecting any user interacting with a crafted link.

3. DOM-Based Cross-Site Scripting

#"><img src=x onerror=alert(1)>

Explanation: The payload is executed through client-side processing, indicating unsafe handling of user input within JavaScript (e.g., dynamic DOM updates). This confirms DOM-based XSS.

4. Internal Backend Information Disclosure

127.0.0.1

Explanation: The response reveals internal system details such as private IP addresses (e.g., 172.26.0.2). This indicates exposure of backend infrastructure and execution flow, which can assist attackers in reconnaissance.

5. Command Injection Payload Behavior Observation

;id

Explanation: The payload is not executed as a system command. However, it is processed and reflected by backend logic, revealing how input is handled internally. This suggests controlled handling but still exposes execution behavior.

6. Template Injection Payload Reflection

{{self.__init__.__globals__}}

Explanation: The payload is reflected without evaluation, confirming that no template engine execution occurs. However, it further demonstrates unsanitized reflection of user input.

7. Additional Backend Processing Exposure

;id

Explanation: The application exposes internal processing steps when handling malformed input. While not directly exploitable, this behavior provides insight into backend operations.

8. HTML Formatting Injection

<u><b><i>Hiii</i></b></u>

Explanation: Formatting tags are rendered successfully, confirming that no output encoding is applied to user input.

Root Cause

• Lack of output encoding for user-controlled input
• Improper input validation
• Unsafe DOM manipulation practices
• Exposure of backend processing details in responses

Recommendations

• Apply strict output encoding for all user inputs
• Implement server-side input validation
• Avoid unsafe DOM APIs such as innerHTML with untrusted data
• Introduce Content Security Policy (CSP)
• Suppress backend processing details from user-facing responses
• Implement centralized input sanitization mechanisms

Conclusion

The application is vulnerable to multiple forms of Cross-Site Scripting due to improper input handling. While deeper exploitation vectors such as command injection or SSRF were not achieved, the exposure of backend behavior and internal details increases the overall attack surface.

The confirmed XSS vulnerabilities pose a significant risk and should be prioritized for remediation.

Disclaimer

This testing was conducted strictly for educational and security research purposes. I do not support or encourage testing on systems without proper authorization. Always ensure you have explicit permission before performing any security testing on live environments.