DOM XSS in jQuery anchor href attribute sink using location.search source

PortSwigger

Description : Make the “back” link execute alert(document.cookie) by exploiting a DOM-based XSS vulnerability in the jQuery $ selector function that changes an anchor element’s href attribute using data from location.search.

Solution Steps

1. Access the lab and navigate to the Submit feedback page.

2. 1. Look for the “back” link on the page.
3. Modify the URL by changing the returnPath query parameter.
   Start by testing with a random alphanumeric string:

https://YOUR-LAB-ID.web-security-academy.net/feedback?returnPath=/test123

4. Right-click and inspect the “back” link to verify your input appears inside an a href attribute.

5. Change the returnPath parameter to a javascript: pseudo-protocol payload:

javascript:alert(document.cookie)

Full URL Example:

6. Press Enter to load the modified URL.

7. Click the “back” link on the page.

8. The alert fires showing the document cookie, and the lab is marked as Solved.

Solved