Vulnerable S1

Support widget

The portal embeds a third-party chat widget in an iframe. The widget talks back with postMessage, and the portal drops whatever arrives straight into the DOM.

window.addEventListener("message", function(event) {
  document.getElementById("output").innerHTML = event.data;
});

No check at all. There is no event.origin test, no event.source test and no check on the shape of the payload — and the payload is parsed as HTML.
One detail worth knowing. innerHTML does not run <script> elements, so a payload dropped into it needs an event handler (<img onerror>, <svg onload>) or a script-capable sink. Switch the sink below to watch the difference.

Drive it from the attacker origin → All scenarios

Sink under test

Widget output

Your session

Set as a cookie so an injected script can steal it.

account: demo.user@acme.test
role: customer
cookie: …

Embedded widget

Served from https://widget.pmlab.amir.baby — a real cross-origin frame.