CVE-2020-11611

An issue was discovered in xdLocalStorage through 2.0.5. The buildMessage function in xdLocalStorage.js specifies the wildcard as the targetOrigin when calling the postMessage function on the iframe object. Therefore any domain that is currently loaded within the iframe can receive the messages...

CVE-2020-11611

An issue was discovered in xdLocalStorage through 2.0.5. The buildMessage function in xdLocalStorage.js specifies the wildcard as the targetOrigin when calling the postMessage function on the iframe object. Therefore any domain that is currently loaded within the iframe can receive the messages...

PT-2020-12725

Name of the Vulnerable Software and Affected Versions xdLocalStorage versions 2.0.5 and earlier Description An issue was discovered in the buildMessage function in xdLocalStorage.js, which specifies the wildcard as the targetOrigin when calling the postMessage function on the iframe object. This...

CVE-2020-11610: Exposure of Resource to Wrong Sphere

An issue was discovered in xdLocalStorage through 2.0.5. The postData function in xdLocalStoragePostMessageApi.js specifies the wildcard as the targetOrigin when calling the postMessage function on the parent object. Therefore any domain can load the application hosting the "magical iframe" and...

PT-2020-12724

Name of the Vulnerable Software and Affected Versions xdLocalStorage versions 2.0.5 and earlier Description An issue was discovered in the postData function in xdLocalStoragePostMessageApi.js, which specifies the wildcard as the targetOrigin when calling the postMessage function on the parent...

CVE-2020-11611: URL Redirection to Untrusted Site

An issue was discovered in xdLocalStorage through 2.0.5. The buildMessage function in xdLocalStorage.js specifies the wildcard as the targetOrigin when calling the postMessage function on the iframe object. Therefore any domain that is currently loaded within the iframe can receive the messages...

PlayStation: Authorization Token on PlayStation Network Leaks via postMessage function

Description After some analysis on how playstation network authentication work, I came across a certain pattern of how authorization tokens are handled. The web application utilizes postMessage function to exchange authorization tokens between windows/frames. To simplify this, let's follow on one...

CVE-2020-8127

Insufficient validation in cross-origin communication postMessage in reveal.js version 3.9.1 and earlier allow attackers to perform cross-site scripting attacks...

CVE-2020-8127

CVE-2020-8127 affects reveal.js 3.9.1 and earlier, where insufficient validation in cross-origin postMessage enables cross-site scripting. Impact is limited to affected reveal.js usage; exploits are not detailed here. Remediation: upgrade to reveal.js 3.9.2 or later. This vulnerability is confirm...

CVE-2020-8127

Insufficient validation in cross-origin communication postMessage in reveal.js version 3.9.1 and earlier allow attackers to perform cross-site scripting attacks...

PT-2020-19964

Name of the Vulnerable Software and Affected Versions reveal.js versions 3.9.1 and earlier Description The issue is related to insufficient validation in cross-origin communication, specifically in the postMessage functionality, which allows attackers to perform cross-site scripting attacks...

CVE-2020-8127: Improper Neutralization of Input During Web Page Generation

Insufficient validation in cross-origin communication postMessage in reveal.js version 3.9.1 and earlier allow attackers to perform cross-site scripting attacks...

Node.js third-party modules: [reveal.js] XSS by calling arbitrary method via postMessage

I would like to report XSS in reveal.js It allows gaining access to the victim's account and performing actions on his behalf Module module name: reveal.js version: 3.8.0 npm page: https://www.npmjs.com/package/reveal.js Module Description A framework for easily creating beautiful presentations...

Upserve : DOM Based XSS via postMessage at https://inventory.upserve.com/login/

Description DOM based XSS is possible at https://inventory.upserve.com/login/ due to insecure origin checking when receiving a postMessage. POC 1. Visit https://hq.upserve.com.████████/upservexss.html 2. Click link 3. View alert on https://inventory.upserve.com Vulnerable Code javascript...

Mail.ru: [XSS] postMessage в jsapi/button

XSS via postMessage handler in o2.mail.ru...

Shopify: H1514 DOM XSS on checkout.shopify.com via postMessage handler on /:id/sandbox/google_maps

Description: The /:id/sandbox/googlemaps and /:id/sandbox/googleautocomplete routes on checkout.shopify.com are used to render the Google Map on the "Order Status" page as well as the address prediction on checkout pages. The page performs origin validation on incoming postMessages making sure th...

HackerOne: Client-Side Race Condition using Marketo, allows sending user to data-protocol in Safari when form without onSuccess is submitted on www.hackerone.com

Hi, I made a talk earlier this month about Client-Side Race Conditions for postMessage on AppSecEU: https://speakerdeck.com/fransrosen/owasp-appseceu-2018-attacking-modern-web-technologies In this talk I mention some fun ways to race postMessages from a malicious origin before the legit source...

Reading Your Emails With A Read&Write Chrome Extension Same Origin Policy Bypass (~8 Million Users Affected)

Summary Due to a lack of proper origin checks in the message passing from regular web pages, any arbitrary web page is able to call privileged background page APIs for the Read&Write Chrome extension vulnerable version 1.8.0.139. Many of these APIs allow for dangerous actions which are not meant ...

Mail.ru: easyXDM allows cross domain postmessaging with any origin, leaking sensitive info

Mail.Ru Agent uses easyXDM library for crossdomain communication between different mail.ru messaging systems. For modern browsers postMessage is used inside. The security issue was because of lacking ACL for domains. So malicious man could in some circumstances he should know victim's email, forc...

Mail.ru: XSS on e.mail.ru via postMessage

URI Get parameters based XSS in https://e.mail.ru/cgi-bin/login via combination of factors controllable script name via NUL characters inection, availability of script with known vulnerability within domain...