Information Disclosure

2020-04-0808:49:56

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.001 Low

EPSS

Percentile

32.7%

JSON

cross-domain-local-storage-separately is vulnerable to information disclosure. The buildMessage() function in xdLocalStorage.js allows the wildcard () as the targetOrigin when calling the postMessage() function on the iframe object, allowing any domains with iframe to accept requests from clients.

CPENameOperatorVersion
cross-domain-local-storage-separatelyeq1.0.0

CPE	Name	Operator	Version
	cross-domain-local-storage-separately	eq	1.0.0

References

github.com/ofirdagan/cross-domain-local-storage

grimhacker.com/2020/04/02/exploiting-xdlocalstorage-localstorage-and-postmessage/#Missing-TargetOrigin-Client

grimhacker.com/exploiting-xdlocalstorage-localstorage-and-postmessage/#Missing-TargetOrigin-Client

0.001 Low

EPSS

Percentile

32.7%

JSON

Related for VERACODE:22970