I'm doing a pentest and came by this code:
(function() {
var subdomain = (function() {
var query = /[?&]css=([^&#]*)/i.exec(window.location.search);
if(query) {
return query[1];
}
var URL = window.location.host.split('.');
if (URL.length > 1) {
return URL[0];
}
})();
if (subdomain) {
var link = document.createElement('link');
link.rel = "stylesheet";
link.href = "/" + subdomain + ".css";
document.getElementsByTagName('head')[0].appendChild(link);
}
})();
It adds a CSS file to the header for rebranding.
The target URL looks like this:
http://some.company.com/p1=test&css=custom
We have controlled the subdomain
parameter here which equals to either query
or URL[0]
.
query
is the result of /[?&]css=([^&#]*)/i.exec(window.location.search);
which equals to custom
in this case.
if the query
is not available in URL, then URL[0]
equals to some
here, I can't think of doing anything useful using URL[0]
because, in order to control its value, I have to change some
to something else which completely changes the URL and points to some other irrelevant page.
Anyway, The final CSS URL would be "/custom.css" or "/some.css" if the CSS
parameter is not available.
I tried some payloads to exploit this but all failed.
Any ideas if this code is vulnerable and how can it be exploited?