Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1tcjVtLTIzODUtMnZjcM4AAkKp

xdlocalstorage does not verify request origin

An issue was discovered in xdLocalStorage through 2.0.5. The postData() function in xdLocalStoragePostMessageApi.js specifies the wildcard (*) as the targetOrigin when calling the postMessage() function on the parent object. Therefore any domain can load the application hosting the "magical iframe" and receive the messages that the "magical iframe" sends.

Permalink: https://github.com/advisories/GHSA-mr5m-2385-2vcp
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tcjVtLTIzODUtMnZjcM4AAkKp
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: almost 2 years ago
Updated: 10 months ago

CVSS Score: 8.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Identifiers: GHSA-mr5m-2385-2vcp, CVE-2020-11610
References:

• https://nvd.nist.gov/vuln/detail/CVE-2020-11610
• https://grimhacker.com/exploiting-xdlocalstorage-localstorage-and-postmessage/#Missing-TargetOrigin-Magic-iframe
• https://github.com/ofirdagan/cross-domain-local-storage/issues/17
• https://github.com/ofirdagan/cross-domain-local-storage/pull/19
• https://github.com/advisories/GHSA-mr5m-2385-2vcp

Repository: https://github.com/ofirdagan/cross-domain-local-storage
Blast Radius: 6.2

Affected Packages