Reflected XSS into a Template Literal with Quotes and Backticks Unicode-Escaped

Introduction

This is the 21st lab in the XSS PortSwigger labs.

Investigation

We can see that we have the same usual website: a blog post and a search bar. The lab indicates that there is a reflected XSS in the search functionality, so let’s see what is going on.

Let’s try to insert something like <nice> in the search bar.

So let’s inspect the source code and see what is going on.

<script>
      var message = `0 search results for '\u003cnice\u003e'`;
      document.getElementById('searchMessage').innerText = message;
</script>

Vulnerability

So we have a user-controlled JS string inside a backtick. Backticks are an ES6 feature that allows developers to write JS inside a string by unpacking variables like this:

let a = 3;

let msg = `This is a nice msg ${a}`

// It will unpack a and print it.

Inside that ${}, we can write almost any JS syntax, so we can make this ${alert()}.

And we solved the lab.

Conclusion

This was a bug we may find in beginner JS code bases, and there are a lot of them.