DOM-Based JavaScript Injection

Description
DOM-based vulnerabilities arise when a client-side script reads data from a controllable part of the DOM and processes this data in an unsafe way. DOM-based JavaScript Injection arises when a script executes controllable data as JavaScript. An attacker may be able to use the vulnerability to construct a URL that will cause JavaScript code to be executed within a user’s browser to steal session tokens or credentials, log keystrokes, or perform unintended actions.

How to reproduce
LMG identified a JavaScript injection point within the web application’s functionality to create or modify studies. Within this functionality, a user could modify the “Protocol Generator” code.

After enabling the “Protocol Configuration” within the study page of the application, LMG inserted an HTML tag to call a vulnerable JavaScript library at https://cdnjs.cloudflare.com/ajax/libs/angular.js/1.4.6/angular.js/.

The web application alerts the user that the code is invalid only after it has been executed.

Additional context
The most effective way to avoid DOM-based JavaScript Injection vulnerabilities is to prevent the execution of JavaScript from untrusted sources. If the functionality of the web application requires this behavior, then defenses should be implemented within the client- side code to sanitize or encode any data that may be submitted.

LMG Document
https://drive.google.com/file/d/18vNuBbHOTZCrTZYvgz7oAbVwzfAJwsdd/view?usp=share_link

Start by locating the client-side code for the study page's Protocol Generator and Protocol Configuration functionality, then reproduce the reported injection using the supplied steps and AngularJS 1.4.6 context. Done means untrusted Protocol Generator data is not executed as JavaScript and invalid input is rejected or safely handled before execution.