I have found an XSS vulnerability which is triggered on a backend admin system from an output sent from a regular user. So this XSS is triggered in an iframe belonging to viewer.exemple.com but loaded from admin.exemple.com The admin page which loads the iframe use postMessage to communicate with this iframe and in the initial request it sends out to viewer.exemple.com an admin token like this:

 <span id='beforeViewer' />
        (function declareViewer() {
          console.log('in declareViewer function')
          const domain = 'https://viewer.exemple.com/';
          const token = 'TOKENTOKEN.';

          console.log('create and insert iframe in in hub')
          const iframe = document.createElement('iframe');

          let minHeight = 1000

            minHeight = 1200

          const height = Math.max(window.innerHeight, minHeight || 0);

          iframe.setAttribute('id', 'iframe_viewer')
          iframe.setAttribute('width', '100%')
          iframe.setAttribute('height', height)
          iframe.setAttribute('src', "https://viewer.exemple.com/communicationrequest/11175128?menu=false")

          window.addEventListener('message', (event) => {
            console.log('listening event message in hub')
            if (event.data === 'ready') {
              console.log('event ready received in hub')
              const iframeContentWindow = document.getElementById('iframe_viewer').contentWindow;
              iframeContentWindow.postMessage(token, domain);
          }, false);

So as I am able to inject script in viewer.exemple.com, I would like to be able to retrieve the token used in the initial postMessage sent from admin.exemple.com to viewer.exemple.com. How could I do this?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.