postmessage

Detectify Labs > postmessage

TLDR; I was able to create a malicious page that would reconnect your Slack WebSocket to my own WebSocket to steal your private Slack token. Slack fixed the bug in 5 hours (on a Friday) and paid me $3,000 for it.

AddThis is a share button used by over a million sites. They were all vulnerable to XSS earlier this year. In my previous post I described the pitfalls of the postMessage API. This post will describe how I identified and exploited them on the AddThis widget.

AddThis Mathias Karlsson postmessage

The postMessage API is an alternative to JSONP, XHR with CORS headers and other methods enabling sending data between origins. It was introduced with HTML5 and like many other cross-document features it can be a source of client-side vulnerabilities.

Mathias Karlsson postmessage

Hacking Slack using postMessage and WebSocket-reconnect to steal your precious token

postMessage XSS on a million sites

The pitfalls of postMessage