I have a site, let's call it parent.com, that embeds a third party plugin from child.com in an iframe. I have found a XSS vulnerability on child.com.

The embedded page from child.com contains a form that POSTs to another page on the same domain. I can exploit the vulnerability by submitting the form. I intercept the POST request with Burp, and insert my payload into it. The payload is then executed.

My problem is that the payload runs inside the iframe on the child.com domain. My goal is to compromise parent.com (in order to win a bug bounty). Is it possible to use this vulnerability to accomplish that somehow? For example, can I somehow make the form submit to parent.com instead?

  • 2
    I don't understand the question. You have one page, example.com. It contains an iframe with the site thirdparty.com/. The thirdparty.com page contains a form, that submits to thirdparty.com as well. There is a XSS vulnerability in the page the form submits to. Is it correct so far? If so, what is it you want to do now?
    – Anders
    Commented Nov 5, 2018 at 15:31
  • No, I have website -> www.exampleSurveys.com which does have iframe of website -> www.exampleForm.com -> i have found XSS vulnerability in their FORM(which is embddeded on www.exampleSurveys.com) on POST request now, my question is how do i sent POST request from www.exampleSurveys.com to www.exampleForm.com so i can redirect users from www.exampleSurveys.com to any other website or XSS. Beacuse if i catch POST request right from www.exampleForm.com i'm not engaging www.exampleSurveys.com website at all.(which i want beacuse its covered by bug bounty program). Hope you understand me now. Commented Nov 5, 2018 at 16:07
  • "i have found XSS vulnerability in their FORM on POST request now," Am I right to guess that "their" refers to exampleForm.com? And is the XSS bug in the page that displays the form, or the page that handles the submitted form?
    – Anders
    Commented Nov 5, 2018 at 16:10
  • Yes, the bug is in the page that displays the form. I want to be able to send POST request which will submit the vulnerable form and will execute script, that would me my Proof Of Concept that this 3rd party vulnerable plugin is also affecting their website. Commented Nov 5, 2018 at 16:27
  • If the XSS vulnerability is in the page that displays the form, why would you want to submit it?
    – Anders
    Commented Nov 5, 2018 at 16:33

2 Answers 2


Iframes have a special tag called "sandbox" that sets how to treat the content of the iframe. Using that tag, you can granularly set permissions to allow an iframe to interact with the parent. Normally iframes are pretty restrictive as to how they can affect a parent when loaded from a different domain, but if you see things like: allow-same-origin, allow-scripts, allow-top-navigation, etc then there may be case specific ways to exploit it.

[edit] Most cases of iframe XSS attacks do not actually involve injecting arbitrary code into the parent website. Instead they are typically one of the following:

  1. You take control of the child website, and replace it with something like a fake login form to make people think that they are loging into the parent website to access the content, when you are really phishing their credentials.
  2. You distribute a "useful" service that other programmers embed in their sites that you actually use to phish private information. Then you pray on people's trust of these other websites to get them to give you something useful. For example: a tax bracket calculator that asks for your name, address, and SSN.
  3. Instead of parent.com, you make an evil twin website called parents.com that contains parent.com inside of an iframe so that it behaves just like the real site, but your version of the website is collecting the end user's private information.

So, the most likely way for you to be able to exploit this scenario would be if you could replace the form with something that looks like a login form for parent.com and post not to parent.com, but to something that you actually control to steal user credentials.

  • Yes, i'm able to insert parent iframe inside this 3rd party plugin . How would i go about executing XSS? So like: Parent.com -> embedded iframe 3rd party Child.com -> Iframe Parent.com Commented Nov 5, 2018 at 22:48
  • and how would i go about sending this POST request so user is redirected to parent.com and from there XSS is executed from child.com iframe. Commented Nov 6, 2018 at 0:04
  • I've edited my answer to better explain how iframe XSS vulnerabilities typically work. I don't think you will be able to do exactly what you have in mind, but there may still be an exploit to be had here that you can collect on.
    – Nosajimiki
    Commented Nov 6, 2018 at 21:12

No this is likely not possible as iframes are restrictive by nature. Remember that all an iFrame is, is a simple GET request to the site included as the source, and then embedding it onto the parent site and allowing further interaction with it. You have describe a POST-XSS vulnerability within the child site, which would be very difficult to automatically trigger in an iframe as it is yet again, only a GET request.

Theoretically speaking you could obviously find a browser exploit which would allow you to execute javascript from a child site into a parent site, but such a thing is much more valuable than any bounty on the parent site. Additionally it would likely still not work in your case, as again you only have POST-XSS.

It is useful to note that although iFrames are restrictive as pointed out by other users and myself, there is an exception made for the javascript: URI. Take for example an iframe like so:

<iframe src="javascript:alert(0)"></iframe>

If this was on a website, not only would you get an alert, but it would be an alert on the 'parent site' as technically there is no child site. This is interesting behavior and proves that iFrames aren't always so 'restrictive'.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .