Create hello.html

[maekuss]

No description provided.

[hacktron-app]

⏭️ Hacktron Security Check — Skipped

Reason: PR review limit reached for this billing period. Spillover billing is available for this org but is not enabled.

Ask your org owner to enable spillover billing on the billing page, or wait for the next billing cycle.

Go to: https://app.hacktron.ai/dscsdsdc/billing

[hacktron-app-stg]

1 issue found across 1 file

Severity	Count
🔴 High	1

View full scan results

[hacktron-app-stg]

🔴 High: Insecure postMessage Origin Validation Leading to DOM-based XSS

The application implements a message event listener that fails to validate the event.origin property before processing the incoming event.data. Furthermore, it uses the innerHTML property to render the untrusted event.data directly into the DOM. This combination allows any malicious origin to execute arbitrary JavaScript in the context of the vulnerable page, leading to DOM-based Cross-Site Scripting (XSS). This vulnerability is present in index.html, hello.html, and test.html.

Steps to Reproduce

1. Open the vulnerable file (e.g., hello.html) in a browser.
2. Open the browser's developer tools console.
3. Execute the following JavaScript: window.postMessage('', '*');
4. Observe that the alert executes, demonstrating successful XSS.

# This script demonstrates the payload that would be sent from a malicious origin.
# The attacker would execute this in a separate window/iframe that has a reference to the vulnerable page.
payload = "<img src=x onerror=alert('XSS_Executed')>"
# The vulnerable page listens to all origins ('*') and does not validate event.origin.
# window.postMessage(payload, '*');
print(f"Payload to send: {payload}")

# No bash script required, use browser console.

# No curl command required, this is a client-side browser vulnerability.

PoC Url: https://example.com

Fix with AI

Fix the following security vulnerability found by Hacktron.

File: hello.html
Lines: 1-67
Severity: high

Vulnerability: Insecure postMessage Origin Validation Leading to DOM-based XSS

Description:
The application implements a `message` event listener that fails to validate the `event.origin` property before processing the incoming `event.data`. Furthermore, it uses the `innerHTML` property to render the untrusted `event.data` directly into the DOM. This combination allows any malicious origin to execute arbitrary JavaScript in the context of the vulnerable page, leading to DOM-based Cross-Site Scripting (XSS). This vulnerability is present in `index.html`, `hello.html`, and `test.html`.

Proof of Concept:
**Steps to Reproduce**

1. Open the vulnerable file (e.g., hello.html) in a browser.
2. Open the browser's developer tools console.
3. Execute the following JavaScript: window.postMessage('<img src=x onerror=alert(document.domain)>', '*');
4. Observe that the alert executes, demonstrating successful XSS.

```python
# This script demonstrates the payload that would be sent from a malicious origin.
# The attacker would execute this in a separate window/iframe that has a reference to the vulnerable page.
payload = "<img src=x onerror=alert('XSS_Executed')>"
# The vulnerable page listens to all origins ('*') and does not validate event.origin.
# window.postMessage(payload, '*');
print(f"Payload to send: {payload}")
```

```bash
# No bash script required, use browser console.
```

```bash
# No curl command required, this is a client-side browser vulnerability.
```


PoC Url: https://example.com

Affected Code:
    window.addEventListener('message', (event) => {
      // Shows the origin but FAILS to validate it (critical bug)
      document.getElementById('origin').textContent = 'Last message origin: ' + event.origin;

      // Dangerous sink: direct innerHTML assignment of untrusted data
      const incoming = typeof event.data === 'string' ? event.data : JSON.stringify(event.data);
      document.getElementById('output').innerHTML = incoming;
    });

Fix this vulnerability. Only change what's necessary - don't modify unrelated code.

---

Triage: Reply !fp <reason> (false positive), !valid (confirmed), or !accepted_risk <reason>. Reason is optional but improves future scans — e.g. !fp internal endpoint, not user-facing. Any other reply is saved as a triage note.

View finding in Hacktron

[maekuss]

!valid

[maekuss]

hello