Executive brief
xdLocalStorage is a JavaScript library that enables cross-domain access to local storage via web messages. The library fails to validate the origin of incoming messages, allowing attackers who trick users into visiting malicious sites to steal or modify sensitive data stored in the local storage of trusted domains. This can lead to account compromise or unauthorized access to stored credentials and personal information.
Technical details
The vulnerability is an improper input validation flaw (CWE-20) in the receiveMessage() function within xdLocalStoragePostMessageApi.js. The function processes incoming postMessage events without verifying the origin of the sender, violating the postMessage API's security recommendations. An attacker can craft malicious web messages from a controlled origin to read or modify local storage data of a victim's trusted site. The attack requires user interaction (victim must load a malicious site) but is network-reachable. No origin whitelisting mechanism is implemented. Patches and fixes are available in later versions of the library.
Affected products
- xdLocalStorage xdLocalStorage through 2.0.5
Timeline
- 2020-04-07: disclosed
- 2021-12-09: advisory