Link to home
Start Free TrialLog in
Avatar of sunhux
sunhux

asked on

verifying if our jquery is vulnerable to XSS by jquery.get

https://jonlabelle.com/snippets/view/javascript/jquery-1124-xss-patch
https://www.cadence-labs.com/2018/07/magento-outdated-jquery-version-how-to-patch-without-upgrading-cve-2015-9251/

Referring to 2nd link above, we're using jquery (though may not be magento).

As instructed above, to run in Chrome console (Alt-Shift-I  or  F12 to invoke console) & enter:
  jQuery.get('https://sakurity.com/jqueryxss');

Q1:
So to verify my URL, I replace sakurity.com  with my URL or I load in the Chrome'
browser my URL & in the console, I enter the above jQuery.get ...  ?  
How do I use it to verify my URL?

Q2:
Tried several URLs & got various returns below, are they pop-ups or what's the
expected value (in the pop-ups) that will indicate my URL is vulnerable or what
other values mean?   The values returned that I got so far:

a)
jQuery.get('https://www.myURL.com/jqueryxss');
{readyState: 1, getResponseHeader: ƒ, getAllResponseHeaders: ƒ, setRequestHeader: ƒ, overrideMimeType: ƒ, …}

b)
jQuery.get('https://sakurity.com/jqueryxss');
{readyState: 1, getResponseHeader: ƒ, getAllResponseHeaders: ƒ, setRequestHeader: ƒ, overrideMimeType: ƒ, …}

c)
jQuery.get('https://www.google.com');
{readyState: 1, getResponseHeader: ƒ, getAllResponseHeaders: ƒ, setRequestHeader: ƒ, overrideMimeType: ƒ, …}
(index):1 Access to XMLHttpRequest at 'https://www.google.com/' from origin 'https://www.jp.com.sg' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
jquery.js:9837 Cross-Origin Read Blocking (CORB) blocked cross-origin response https://www.google.com/ with MIME type text/html. See https://www.chromestatus.com/feature/5629709824032768 for more details.
ASKER CERTIFIED SOLUTION
Avatar of leakim971
leakim971
Flag of Guadeloupe image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial