Conversation
|
📍 test12.html:81 🟢 Sensitive Data Exposure #50 Severity: low Description: Security vulnerability #50: Sensitive Data Exposure found in test12.html at line 81. This vulnerability could allow attackers to compromise the application security. Proof of Concept: Finding ID: 40c9baf6-a624-448a-ac62-ffcf25c95fca |
![hacktron-app-dev[bot]](https://avatars.githubusercontent.com/in/1508381?s=60&v=4){kind=small}
| <script> | ||
| // VULNERABLE IMPLEMENTATION — DO NOT USE IN PRODUCTION | ||
| // This listener accepts messages from ANY origin and injects the data into the DOM without sanitization. | ||
| window.addEventListener('message', (event) => { |
There was a problem hiding this comment.
🔴 Insecure postMessage without Origin Validation
Severity: high
File: test12.html (Line 30)
Description: The application accepts postMessage events from any origin without validation, allowing malicious websites to inject arbitrary HTML content into the DOM. This creates a cross-site scripting (XSS) vulnerability.
Proof of Concept:
1. Open test12.html
2. Run: window.opener.postMessage("<img src=x onerror=alert(\"XSS\")>", "*")
3. Script executes without origin validation
Finding ID: 550e8400-e29b-41d4-a716-446655440007
| <script> | ||
| // VULNERABLE IMPLEMENTATION — DO NOT USE IN PRODUCTION | ||
| // This listener accepts messages from ANY origin and injects the data into the DOM without sanitization. | ||
| window.addEventListener('message', (event) => { |
There was a problem hiding this comment.
🔴 Insecure postMessage without Origin Validation
Severity: high
File: test12.html (Line 30)
Description: The application accepts postMessage events from any origin without validation, allowing malicious websites to inject arbitrary HTML content into the DOM. This creates a cross-site scripting (XSS) vulnerability.
Proof of Concept:
1. Open test12.html
2. Run: window.opener.postMessage("<img src=x onerror=alert(\"XSS\")>", "*")
3. Script executes without origin validation
Finding ID: 550e8400-e29b-41d4-a716-446655440007
| <script> | ||
| // VULNERABLE IMPLEMENTATION — DO NOT USE IN PRODUCTION | ||
| // This listener accepts messages from ANY origin and injects the data into the DOM without sanitization. | ||
| window.addEventListener('message', (event) => { |
There was a problem hiding this comment.
🔴 Insecure postMessage without Origin Validation
Severity: high
File: test12.html (Line 30)
Description: The application accepts postMessage events from any origin without validation, allowing malicious websites to inject arbitrary HTML content into the DOM. This creates a cross-site scripting (XSS) vulnerability.
Proof of Concept:
1. Open test12.html
2. Run: window.opener.postMessage("<img src=x onerror=alert(\"XSS\")>", "*")
3. Script executes without origin validation
Finding ID: 550e8400-e29b-41d4-a716-446655440007
1 participant
No description provided.