Webverselabs Fieldnote Challenge XSS

Scenario :

Fieldnote is a journaling app for field biologists. Colleagues paste links to related papers or references and share them via a /share?u= URL. The filter is one line — if the URL doesn’t contain ‘http’, replace it with a safe default. The filter author didn’t think about what ‘contains’ actually means.

Solution :

First we start by navigating the webapp just like a normal user.

We first explore the different endpoints :

/Journal :

Nothing useful here, just a static web page .

/Species :

Same thing here as well . Nothing useful really.

/Cite :

Here we see that we can actually Reference a URL , I would start by testing for a SSRF but since this challenge is for XSS , i will save our time and go for XSS directly :)

/Journal :

Before we dig deeper in the /Cite endpoint i wanted to finish exploring the app , found this /Journal endpoint but this wasn’t helpful either .

Now back to our /Cite endpoint . I first sent a URL then checked Burp’s History to get a better idea of what’s going on.

We see that it is sent as a GET Request via the url parameter :

For us to add a reference url the input MUST contain http otherwise it just gets ignored by the server :

Now i figured i use a payload that contains HTTP inside of it, and try to call our WebHook URL, and hopefully it works .

But checking our webhook site , we don’t see any connections being made -_-

If we check the Front end code :

We see that our payload is put inside an href , which means it won’t be executed -_- cause script tags don’t usually execute inside an href , BUT we can run Javascript directly here , using a payload like windows origin , as long as we got HTTP inside of our payload , it should satisfy the filter .

javascript:alert(window.origin)//http : HTTP here is treated as a comment (//) .
//javascript: Inside the href is a valid link . so it will run if we click it . 

//http satisfies the filter since it has HTTP while it gets ignored by the JavaScript interpreter.

Now if we click on it , we should trigger the XSS.

And we do :

And just like that we are able to get our flag :

That was all for this challenge, see you in the next one :)