XSS in Salesforce Aura Components: A Creative Exploitation Breakthrough

By /

Listen to this Post

Featured Image

Introduction

Cross-Site Scripting (XSS) remains a critical web security vulnerability, allowing attackers to inject malicious scripts into trusted websites. XBOW’s latest discovery demonstrates how unconventional testing methods can uncover XSS flaws even in hardened platforms like Salesforce Aura Components. By defying conventional assumptions, they bypassed traditional defenses, proving the importance of persistent and creative security testing.

Learning Objectives

  • Understand how parameter manipulation can bypass content-type restrictions in XSS attacks.
  • Learn the role of `aura.tag` and `aura.format` in Salesforce Aura Components and how they can be exploited.
  • Discover how SVG `onload` handlers can evade script tag filters.

You Should Know

1. Content-Type Manipulation for XSS

Command/Code Snippet:

GET /aura?aura.tag=malicious_payload&aura.format=JSON HTTP/1.1 
Host: vulnerable.salesforce.com

Step-by-Step Guide:

  1. Identify a reflected parameter (e.g., aura.tag) in Salesforce Aura endpoints.
  2. Observe that the server responds with text/plain, preventing script execution.
  3. Append `aura.format=JSON` to force the server to return `text/html` instead.
  4. The payload is now interpreted as HTML, enabling XSS.

2. Bypassing Script Filters with SVG `onload`

Code Snippet:


<

svg onload=alert(document.domain)>

Step-by-Step Guide:

  1. Traditional `