CVE-2020-11610
HIGHCross Domain Local Storage < 2.0.5 - Exposure to Wrong Actor
Title source: ruleDescription
An issue was discovered in xdLocalStorage through 2.0.5. The postData() function in xdLocalStoragePostMessageApi.js specifies the wildcard (*) as the targetOrigin when calling the postMessage() function on the parent object. Therefore any domain can load the application hosting the "magical iframe" and receive the messages that the "magical iframe" sends.
References (2)
Core 2
Core References
Product x_refsource_misc
https://github.com/ofirdagan/cross-domain-local-storage
Exploit, Third Party Advisory x_refsource_misc
https://grimhacker.com/exploiting-xdlocalstorage-localstorage-and-postmessage/#Missing-TargetOrigin-Magic-iframe
Scores
CVSS v3
8.8
EPSS
0.0023
EPSS Percentile
45.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Details
CWE
CWE-668
Status
published
Products (2)
cross_domain_local_storage_project/cross_domain_local_storage
< 2.0.5
npm/xdlocalstorage
0npm
Published
Apr 07, 2020
Tracked Since
Feb 18, 2026