# XSS via error and JSONP reflection

Request data echoed unescaped into script or HTML by error handlers and JSONP callbacks

_Area: Web injection and code execution. Seen in 3 disclosed reports; latest 2025-02-12. Updated 2026-10-24._

## How it works
A server takes attacker-influenced input and writes it into a response that a browser parses as script or HTML, without escaping. The broken assumption is that error paths and callback wrappers are "safe" because they are not the normal page render. In practice, framework exception messages often quote the offending input verbatim, and JSONP wrappers place a parameter directly into a function call. If the sink is HTML, the input becomes markup; if the sink is a JS argument, it becomes code. The reflection may not be directly reachable, so a second channel (a push/JSONP update) can carry the same value to another user [E2](https://bugbountylibrary.com/r/h1%3A259100.md).

## Where to review
- Error handlers that interpolate exception text into HTML, especially framework parse errors that echo attribute or element values [E1](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-continuing-the-citrix-saga-cve-2023-5914-cve-2023-6184.md).
- JSONP callbacks where a request parameter is placed as a function argument without quoting/escaping [E2](https://bugbountylibrary.com/r/h1%3A259100.md).
- Endpoints that return `{value:null}` or similar but still push updates to a channel identified by a client-supplied id [E2](https://bugbountylibrary.com/r/h1%3A259100.md).
- Client code assigning server error text to `innerHTML` rather than text content [E3](https://bugbountylibrary.com/r/h1%3A2246576.md).
- Test/debug endpoints reachable without authentication [E1](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-continuing-the-citrix-saga-cve-2023-5914-cve-2023-6184.md).

## How to review
Trace every request parameter to its output sink. The invariant: any value that reaches an HTML or script context must be context-appropriately encoded, or the response must be served with a type that browsers do not execute. For JSONP, confirm the callback argument is a properly quoted string literal, not raw. For error reflection, confirm exception messages are escaped before interpolation. For push channels, confirm the channel/window id is bound to the caller's session before delivery [E2](https://bugbountylibrary.com/r/h1%3A259100.md). For DOM sinks, confirm error text uses `textContent`, not `innerHTML` [E3](https://bugbountylibrary.com/r/h1%3A2246576.md).

## Variants seen
- Unauthenticated reflected XSS via XML parse error echoing an attribute value in a SAML test endpoint [E1](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-continuing-the-citrix-saga-cve-2023-5914-cve-2023-6184.md).
- Cross-user XSS via JSONP channel update where `window_id` was not session-bound [E2](https://bugbountylibrary.com/r/h1%3A259100.md).
- HTML injection via `innerHTML` from a validation error, escalated with script gadgets despite CSP [E3](https://bugbountylibrary.com/r/h1%3A2246576.md).

## Why fixes fail
CSP alone did not stop E3; existing on-site script gadgets were repurposed to act and mint CSRF tokens. Escaping one sink while a secondary push channel echoes the same parameter leaves the hole open [E2](https://bugbountylibrary.com/r/h1%3A259100.md).

## Impact and severity
Unauthenticated reflected XSS in an appliance test endpoint [E1](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-continuing-the-citrix-saga-cve-2023-5914-cve-2023-6184.md); cross-user script execution via a push channel [E2](https://bugbountylibrary.com/r/h1%3A259100.md); HTML injection escalated to CSRF-token-backed account changes [E3](https://bugbountylibrary.com/r/h1%3A2246576.md). Severity rises with unauthenticated reach, cross-user delivery, and available script gadgets.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-continuing-the-citrix-saga-cve-2023-5914-cve-2023-6184.md
- E2: https://bugbountylibrary.com/r/h1%3A259100.md
- E3: https://bugbountylibrary.com/r/h1%3A2246576.md