How exploitable is a site listening to browser messages from anyone?
I am working on a site where I have found some iframe issues. The case is that site A has an iframe of site B, and site A listens to 'messages' from anywhere and then it can perform two different actions when a message comes in:
- Set document.location = "incoming message data"
- Create a form, and set the action attribute value to "incoming message data", add it to the DOM and then submit the form.
- I could set up a key listener on site Evil and make site A iframe fill the screen asking for a login, in that way harvesting logins for site A. This would require some social engineering to work properly.
But this is the best I can come up with, so my question is, have I completely overlooked something? Googling around doesn't yield any other options.
Obviously this opens site A (whom I work for) up for XSS through site B (who is a semi known company, but still). Another point I am thinking about making is why on earth would anyone do ANYTHING this way? Create a form and submit and answer with some received data? I can't figure out a good reason to do it like this, maybe any of you good people can?