Pwning WebAssembly Bypassing XSS Filters in the WASM Sandbox

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://zoozoo-sec.github.io/blogs/PwningWasm-BreakingXssFilters/
• Blog Title: Pwning WebAssembly: Bypassing XSS Filters in the WASM Sandbox
• Suggested Section: Web Pentesting -> XSS -> Bypass Techniques (WASM linear-memory corruption pivot)

🎯 Content Summary

Goal: Show, step‑by‑step, how a memory‑corruption bug inside a WebAssembly (WASM) module becomes a reliable DOM XSS by corrupting data in linear memory and overwriting an in‑memory HTML template. Target is a CTF app (Pentathon CTF 2025 “chaat”); no CVE.

How WASM runs (brief but actionable):
• Tiered compilation (V8): Liftoff compiles fast baseline machine code; Turbofan later optimizes hot paths for near‑native speed.
• Memory ...

🔧 Technical Details

Intra‑WASM heap overflow → pointer corruption: Find an edit path that memcpy’s into a fixed buffer without resizing. Overflow into adjacent structs (e.g., an array of msg) to overwrite pointers, yielding arbitrary read/write of in‑sandbox data that later reaches sensitive sinks.

Groom with realloc() to force adjacency: Fill a dynamic array to trigger realloc(); after growth, it often lands right after attacker‑controlled data. Use this placement to deterministically corrupt structure fields (like msg_data pointers).

Sink pivot via template overwrite (bypass sanitizer): Instead of injecting tags in input, overwrite a writable HTML template string in linear memory from “<p>%.*s</p>” to “<img src=1 onerror=%.*s>”. Sanitized content then becomes a JS handler value; any JS text (e.g., alert(1337)) executes.

🤖 Agent Actions

I explored the repository and confirmed there wasn’t any WASM-specific XSS bypass technique documented. The closest areas were:

• pentesting-web/xss-cross-site-scripting/README.md (general XSS techniques)
• pentesting-web/xss-cross-site-scripting/dom-xss.md
• pentesting-web/xss-cross-site-scripting/integer-overflow.md (not related to WASM)
• binary-exploitation/chrome-exploiting.md (browser engine exploitation with WASM, but not app-level WASM-to-DOM XSS)
• reversing/reversing-tools-basic-methods/README.md (WASM reversing tools)

Given the blog’s focus (WASM linear-memory corruption to DOM XSS by overwriting an in-memory HTML template), the best place is within the XSS documentation as a dedicated bypass technique page. I implemented:

1. New page: WebAssembly linear memory corruption to DOM XSS (template overwrite)

• Path: src/pentesting-web/xss-cross-site-scripting/wasm-linear-memory-template-overwrite-xss.md
• Content:
  • Abstracted technique: pivot to corrupt writable HTML templates in WASM linear memory to bypass source-side sanitization.
  • Emscripten/Module.cwrap/HEAPU8 context and DevTools workflow.
  • Vulnerable C structs and functions pattern (unchecked memcpy in edit path).
  • Grooming with realloc to position s->mess near attacker buffers.
  • Deterministic template location and modification (e.g., change "

    %.*s

    " to "").
  • Concrete exploitation steps and an action list PoC.
  • Defensive guidance for engineers.
  • References added at the end including the blog URL and WASM/V8 resources.
  • Proper HackTricks banners included.

2. Added a link in the main XSS page

• File updated: src/pentesting-web/xss-cross-site-scripting/README.md
• Inserted under “Other Bypasses” a subsection:
  • “Bypassing sanitization via WASM linear-memory template overwrite” with a concise summary.
  • Internal link to the new page using the proper {{#ref}} macro.

No other files were modified. The changes integrate the blog’s techniques into the most relevant HackTricks section (Web Pentesting → XSS), focusing on the key exploitation chain and defensive guidance while maintaining HackTricks style and structure.

If anything else is desired (e.g., cross-linking from DOM XSS), I can add it, but the main XSS page now properly references the new technique page.

Actions performed:

• Created: src/pentesting-web/xss-cross-site-scripting/wasm-linear-memory-template-overwrite-xss.md
• Modified: src/pentesting-web/xss-cross-site-scripting/README.md (added new subsection and ref link)

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

🗑️ File Cleanup

• searchindex.js removed: This auto-generated file has been removed to prevent conflicts.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://zoozoo-sec.github.io/blogs/PwningWasm-BreakingXssFilters/

Content Categories: Based on the analysis, this content was categorized under "Web Pentesting -> XSS -> Bypass Techniques (WASM linear-memory corruption pivot)".

Repository Maintenance:

• MD Files Formatting: 877 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0