Executive brief
xdlocalstorage is a JavaScript library that enables cross-domain access to local storage by using a "magic iframe" and postMessage communication. The library fails to verify the origin of incoming requests, allowing any website to read or modify data stored in domains where xdlocalstorage is deployed. An attacker can host the vulnerable application in an iframe on a malicious site and intercept sensitive localStorage data from users who visit both domains.
Technical details
The vulnerability exists in the postData() function in xdLocalStoragePostMessageApi.js, which uses a wildcard ("*") as the targetOrigin parameter when calling postMessage() on the parent object. This means the iframe broadcasts all localStorage messages to any window origin without validation. An attacker can load the vulnerable application in an iframe on a malicious domain and receive the postMessage events containing localStorage contents. The vulnerability requires user interaction (the user must visit a malicious website hosting the iframe). Patches should restrict targetOrigin to specific trusted domains and validate the sender's origin on message receipt.
Affected products
- xdlocalstorage xdlocalstorage through 2.0.5
Timeline
- 2020-04-07: disclosed
- 2022-05-24: advisory