Lab 42 — ProsePad — DOM Clobbering to Stored XSS

hackadvisor

Task: ProsePad collaborative writing platform sanitizes article HTML but preserves id/name attributes and data: URIs in href; a widget loader script reads window.appConfig.cdnUrl to load a script. Solution: DOM clobbering via two anchor elements with same id creates HTMLCollection, named access via name attribute provides attacker-controlled data:text/javascript URI as script src, exfiltrating admin flag via comment API.