Vulnerable
S4
Session sync
The portal pushes its session context to the widget. It uses
"*" as the target origin, so the data goes to
whatever window happens to be on the other end.
window.postMessage("Sensitive data", "*");
const sessionContext = { type: "session-context", sessionToken: "..." };
window.postMessage(sessionContext, "*"); // broadcast inside this window
if (window.opener) window.opener.postMessage(sessionContext, "*"); // whoever opened us
if (window.parent !== window) window.parent.postMessage(sessionContext, "*"); // whoever framed us
Three ways the data leaks.
•
•
•
In every case the target origin is
•
window.postMessage(…, "*") — delivered to this
window; any script in this page can listen for it.
•
window.opener.postMessage(…, "*") — delivered to
whoever opened this page. The attacker's
window.open() becomes the sink.
•
window.parent.postMessage(…, "*") — delivered to
whoever embedded this page. An attacker who can iframe the portal becomes the sink.
In every case the target origin is
"*", so the receiver
never gets to check whether it was meant to receive the data.
What is being broadcast
—
Your session
- account
- demo.user@acme.test
- role
- customer
- session token
- acme_live_4f8c2a91d7e65b30
Embedded widget
Served from https://widget.pmlab.amir.baby.