GHSA-mr5m-2385-2vcp
xdlocalstorage does not verify request origin
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | xdlocalstorage | <= 2.0.5 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
An issue was discovered in xdLocalStorage through 2.0.5. The `postData()` function in `xdLocalStoragePostMessageApi.js` specifies the wildcard (`*`) as the targetOrigin when calling the `postMessage()` function on the parent object. Therefore any domain can load the application hosting the "magical iframe" and receive the messages that the "magical iframe" sends.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2020-11610
- https://github.com/ofirdagan/cross-domain-local-storage/issues/17
- https://github.com/ofirdagan/cross-domain-local-storage/pull/19
- https://github.com/ofirdagan/cross-domain-local-storage
- https://grimhacker.com/exploiting-xdlocalstorage-localstorage-and-postmessage/#Missing-TargetOrigin-Magic-iframe