Webverselabs Challenge Chorus Reflected XSS

Scenario :

Chorus is an indie music review site. The dev added a personal “Hi, !" greeting using an inline script that calls htmlspecialchars — but without ENT_QUOTES. Angles are escaped. Quotes aren't. Guess which one matters inside a JavaScript string literal.

Solution :

We first start by using the app just like a normal user, discover different endpoints , features, etc.

/Artists :

This returns a static page , nothing useful for us .

/Reviews :

Another static page , but this time we can generate a mixstape , we also have a Sumit botton that redirects us to this :

Basically nowhere :)

Let’s explore the mixtape generation endpoint :

Whatever we type gets reflected back to us :

If we check Burp’s Request :

A simple GET request containing our parameter , now i started by using a basic XSS payload :

<script>alert(window.origin)</script>

We see that our tags get encoded by the server, which causes the browser to treat them as plain text instead of HTML.

Whenever we see something like this , we can always try some Filter Bypasses before anything :

https://cheatsheetseries.owasp.org/cheatsheets/XSS_Filter_Evasion_Cheat_Sheet.html

After trying some of these payloads , this one worked perfectly :

<svg/onload='+/"`/+/onmouseover=1/+/[*/[]/+alert(42);//'>
--> <svg> is an inline HTML5 element — valid in modern browsers without needing <html> or <body> context
--> / between svg and onload acts as a whitespace substitute — some filters only check for <svg onload with a space
--> onload fires automatically, no user interaction needed (unlike onmouseover) 

Few assumptions for why this worked :

The filter was encoding script tags fine, but it never accounted for svg so that slipped through as raw HTML. The / instead of a space between svg and onload also helped dodge any pattern matching. Once the browser got the unencoded tag, it rendered the SVG and onload fired automatically, no clicks or hovers needed. The weird characters around alert(42) are just there to confuse filters looking for obvious strings like alert( the browser doesn’t care about the mess, it runs it fine anyway.

Once our XSS is triggered, we should get our flag :

That was all for this challenge , see you in the next one :)