CVE-2020-11610 xdlocalstorage does not verify request origin
An attacker can intercept sensitive messages sent by the library because it uses a wildcard target origin in postMessage calls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-11610?
CVE-2020-11610 is a high-severity vulnerability in n/a, published on 7 Apr 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An issue was discovered in xdLocalStorage through 2.0.5. The postData() function in xdLocalStoragePostMessageApi.js specifies the wildcard (*) as the targetOrigin when calling the postMessage() function on the parent object. Therefore any domain can load the application hosting the "magical iframe" and receive the messages that the "magical iframe" sends.
Weakness: CWE-668
Which versions are affected by CVE-2020-11610?
2 open source packages ship an affected version, including xdlocalstorage. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
xdlocalstorage npm | All versions to 2.0.5 | None |
xdlocalstorage npm | All versions to 2.0.5 | None |
Products include Cross Domain Local Storage Project Cross Domain Local Storage.
How do I fix CVE-2020-11610?
No fix has been published for CVE-2020-11610 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-11610 being exploited?
There is no known exploitation of CVE-2020-11610 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-mr5m-2385-2vcp.