Hi all,

I recently identified an XSS vulnerability in an <img> tag where the reflection of a query parameter occurs in the src attribute.

URL: https://example.com?dir=123

Response:

<img src="123/tracking.gif">

I know the obvious payload is

x" onerror="alert(1)" y="

But it got me thinking if a Javascript or Data URI could be used so XSS could be achieved without quotes.

I've tried using payloads like javascript:alert(1);// and data:text/html;base64,PHNjcmlwdD5hbGVydCgiSGV
sbG8iKTs8L3NjcmlwdD4= but it doesn't seem like they work. I'm not sure if javascript URI's can have comments. I'm also not sure if the trailing path of the gif would completely break any URI injection.

The OWASP XSS filter cheatsheet has numerous examples of "Image XSS using the JavaScript directive" featured: https://owasp.org/www-community/xss-filter-evasion-cheatsheet

However... I can't even get those to work by themselves.

When attempting to test the basic img URI payload: <img src="javascript:alert(1)">

• Chrome throws a "ERR_UNKNOWN_URL_SCHEME" in the console, no alert

• Firefox says "Could not load image" when reviewing the elements in Inspector, no alert

• Edge and IE don't provide any additional clues, no alert

So can someone tell me:

• Why does OWASP still say that xss via javascript URI in an img tag still works? (might have to send them an email to update the cheatsheet!)

• What changed in modern browsers that prevents this payload from working?

• Are there any URI XSS payloads that would work in my scenario or img tags general?

Thanks!