From Intigriti challenge to a Vue.js script gadget

Intigiriti’s November challenge by IvarsVids was about a Vue.js one-pager that reflected user input with some replacements. After visiting the challenge homepage at we quickly notice it reflects s query parameter not escaping HTML less than and greater than signs resulting in HTML injection.

s parameter reflection

But the page refuses the execute the injected script because of the content security policy base-uri 'self'; default-src 'self'; script-src 'unsafe-eval' '<emitted>' 'strict-dynamic'; object-src 'none'; style-src '<emitted>'

CSP blocking

As we see unsafe-eval directive is present, which means dynamically eval’ed script will be allowed, so we can try vue.js template injection. To achieve that we should inject our element with app “id”, close the <title> with a payload like </title><div id=app></div> and inject the payload within the div. Template delimiters are set to v-{{ and }} on line 45 but after trying to inject templates or general script gadgets from Portswigger’s cheatsheet the WAF is replacing keywords with % characters.

replacing keywords

Looking for a potential execuntion sink I refered to Vue api at and found slot-scope deprecated special attribute which is expecting function argument expression. Trying to inject payload like </title><div id=app><p slot-scope="function(){alert()}"></div> we get the following expection.

thrown exception

So to execute javascript we should close the function expression and then execute our javascript code, but also please note the injection point is within a smaller scope and window parameters are not within this scope. To escape to window scope we can try the classic this.constructor.constructor chain. Injecting a payload like the following we get another exception</title><div id="app"><p slot-scope="){}}])-this.constructor.constructor('alert(origin)')()})};//"></div>

thrown exception 2

WAF has replaced is from this with %is% as it is another known script gadget attribute, but we can bypass this using a function from the local scope, e.g. </title><div id="app"><p slot-scope="){}}])-_c.constructor.constructor('alert(origin)')()})};//"></div>

successfull execution

For the intended solution check Intigriti’s guide at