Executive brief
xdLocalStorage is a JavaScript library that enables cross-domain access to browser local storage. The library fails to validate the origin of incoming web messages, allowing an attacker to craft a malicious webpage that, when visited by a user, can read or modify sensitive data stored by legitimate websites in the victim's browser. This could lead to account compromise or exposure of user credentials and private information.
Technical details
The vulnerability is an improper input validation flaw (CWE-20) in the receiveMessage() function of xdLocalStorage.js. The function processes cross-origin messages via the postMessage API without validating the origin of the sender. This allows a malicious attacker controlling a website to send crafted messages that access or tamper with local storage data from other domains. The attack requires user interaction (visiting a malicious site), and can result in both confidentiality and integrity violations of local storage data. The vulnerability affects xdLocalStorage versions through 2.0.5; patches addressing origin validation are available.
Affected products
- xdLocalStorage xdLocalStorage through 2.0.5
Timeline
- 2015-08-13: disclosed: Issue opened on GitHub describing missing origin whitelisting
- 2020-04-07: advisory: CVE-2015-9545 published in NVD
- 2021-12-09: advisory: GHSA-76qm-4f93-fg6f advisory published