Add insecure postMessage example in index1.html

[maekuss]

This HTML file demonstrates an insecure postMessage implementation that lacks origin validation, allowing potential cross-site scripting (XSS) vulnerabilities.

[hacktron-app]

⏭️ Hacktron Security Check — Skipped

Reason: PR review limit reached for this billing period. Spillover billing is available for this org but is not enabled.

Ask your org owner to enable spillover billing on the billing page, or wait for the next billing cycle.

Go to: https://app.hacktron.ai/dscsdsdc/billing

[hacktron-app-stg]

1 issue found across 1 file

Severity	Count
🔴 High	1

View full scan results

[hacktron-app-stg]

🔴 High: Origin Validation Bypass and DOM XSS via postMessage

The application implements a window.addEventListener('message', ...) listener that processes messages from any origin without validating the event.origin property. This allows any malicious website to send arbitrary messages to the application. Furthermore, the application directly assigns the event.data to the innerHTML property of a DOM element, leading to a Cross-Site Scripting (XSS) vulnerability. This bypasses the browser's Same-Origin Policy (SOP) boundary, which is intended to protect the application from untrusted cross-origin interactions.

Steps to Reproduce

1. Open index1.html in a browser.
2. Open a separate tab in the same browser (e.g., example.com).
3. In the console of the second tab, run: window.opener.postMessage('<img src=x onerror=alert("XSS")>', '*');
4. Observe the alert on the vulnerable page.

# No python script required, this is a browser-based vulnerability.

# No bash script required, this is a browser-based vulnerability.
# To trigger:
# 1. Open index1.html in a browser.
# 2. In the console of another tab, execute:
# window.opener.postMessage('<img src=x onerror=alert("XSS")>', '*');

N/A

PoC Url: N/A

Fix with AI

Fix the following security vulnerability found by Hacktron.

File: index1.html
Lines: 1-67
Severity: high

Vulnerability: Origin Validation Bypass and DOM XSS via postMessage

Description:
The application implements a window.addEventListener('message', ...) listener that processes messages from any origin without validating the event.origin property. This allows any malicious website to send arbitrary messages to the application. Furthermore, the application directly assigns the event.data to the innerHTML property of a DOM element, leading to a Cross-Site Scripting (XSS) vulnerability. This bypasses the browser's Same-Origin Policy (SOP) boundary, which is intended to protect the application from untrusted cross-origin interactions.

Proof of Concept:
**Steps to Reproduce**

1. Open index1.html in a browser.
2. Open a separate tab in the same browser (e.g., example.com).
3. In the console of the second tab, run: window.opener.postMessage('<img src=x onerror=alert("XSS")>', '*');
4. Observe the alert on the vulnerable page.

```python
# No python script required, this is a browser-based vulnerability.
```

```bash
# No bash script required, this is a browser-based vulnerability.
# To trigger:
# 1. Open index1.html in a browser.
# 2. In the console of another tab, execute:
# window.opener.postMessage('<img src=x onerror=alert("XSS")>', '*');
```

```bash
N/A
```


PoC Url: N/A

Affected Code:
    window.addEventListener('message', (event) => {
      // Shows the origin but FAILS to validate it (critical bug)
      document.getElementById('origin').textContent = 'Last message origin: ' + event.origin;

      // Dangerous sink: direct innerHTML assignment of untrusted data
      const incoming = typeof event.data === 'string' ? event.data : JSON.stringify(event.data);
      document.getElementById('output').innerHTML = incoming;
    });

Fix this vulnerability. Only change what's necessary - don't modify unrelated code.

---

Triage: Reply !fp <reason> (false positive), !valid (confirmed), or !accepted_risk <reason>. Reason is optional but improves future scans — e.g. !fp internal endpoint, not user-facing. Any other reply is saved as a triage note.

View finding in Hacktron