CVE-2020-11610: xdlocalstorage missing request origin verification

CVE-2020-11610 · Severity: low · CVSS 3.1 · Published 2022-05-24

xdlocalstorage is a JavaScript library that enables cross-domain access to local storage by using a "magic iframe" and postMessage communication. The library fails to verify the origin of incoming requests, allowing any website to read or modify data stored in domains where xdlocalstorage is deployed. An attacker can host the vulnerable application in an iframe on a malicious site and intercept sensitive localStorage data from users who visit both domains.

Technologies: xdlocalstorage (npm). Vendors: npm.

Quick answers

Is CVE-2020-11610 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2020-11610 being exploited in the wild.
How severe is CVE-2020-11610?
Low severity, with a CVSS score of 3.1, published 24 May 2022.
Which products and versions are affected?
xdlocalstorage (npm) SEMVER:introduced=0,last_affected=2.0.5.
Is there a fix for CVE-2020-11610?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2020-11610 attacked?
It is attacked over the network.
Am I affected by CVE-2020-11610?
Check whether you run xdlocalstorage (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the postData() function in xdLocalStoragePostMessageApi.js, which uses a wildcard ("*") as the targetOrigin parameter when calling postMessage() on the parent object. This means the iframe broadcasts all localStorage messages to any window origin without validation. An attacker can load the vulnerable application in an iframe on a malicious domain and receive the postMessage events containing localStorage contents. The vulnerability requires user interaction (the user must visit a malicious website hosting the iframe). Patches should restrict targetOrigin to specific trusted domains and validate the sender's origin on message receipt.

Affected products

  • xdlocalstorage xdlocalstorage through 2.0.5

Identifiers

  • CVE-2020-11610
  • GHSA-mr5m-2385-2vcp

Timeline

  • 2020-04-07: disclosed
  • 2022-05-24: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.