CVE-2020-11023 PoC — Potential XSS vulnerability in jQuery

Source

https://github.com/Cybernegro/CVE-2020-11023

Associated Vulnerability

Title:Potential XSS vulnerability in jQuery (CVE-2020-11023)
Description:In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Description

CVE-2020-11023  PoC for bug bounty.

Readme


# CVE-2020-11023 POC Dom XSS
This proof of concept, demostraste an security flaw of dom-bases XSS manipulating and using JQuery DOM Methods. eg:(.append, .text,.html)


Payload i used:
alert("Text: " + $("#test").text());


To test the vulnerability do the following:

1. Open and web console, on your browser and in the scope site.

2. Go to the console window and put the following payload:

3. Payload: 
alert("Text: " + $("#test").text());

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!