# A smorgasbord of a bug chain: postMessage, JSONP, WAF bypass, DOM-based XSS, CORS, CSRF…

Chain of postMessage listener without origin check, JSONP callback injection, WAF bypass, and permissive CORS yields DOM XSS and one-click CSRF profile takeover.

- Payout: unconfirmed
- Severity: high
- Program: -
- Credited: Julien Cretel
- Disclosed: 2023-05-05
- Write-up quality: 8/10
- Original: https://jub0bs.com/posts/2023-05-05-smorgasbord-of-a-bug-chain/
- Library page: https://bugbountylibrary.com/r/blog%3Ajub0bs-com-posts-2023-05-05-smorgasbord-of-a-bug-chain
- Tags: domain:web impact:integrity kind:bounty platform:blog sev:high tech:rest technique:chained technique:js-analysis vuln:cors vuln:csrf vuln:xss

**Target:** Web app: postMessage listener, JSONP endpoint, CORS-protected profile API
**Root cause:** A message event listener on out-of-scope.redacted.com/search lacked an origin check and dispatched attacker-controlled method strings to window.APP functions, including apiCall which built a JSONP URL with an insufficiently validated callback; the profile endpoint's CORS reflected any *.redacted.com origin.
**Steps:**
1. Observe /profile CORS reflects any https://*.redacted.com origin: `curl -H 'Origin: https://whatever.redacted.com' -H 'Cookie: sid=...' https://www.redacted.com/profile`
2. Find message listener on https://out-of-scope.redacted.com/search with no origin check that calls `window.APP[method...](arg)`
3. Bypass Akamai WAF by dropping `?`: `GET https://search.redacted.com/&callback=alert&output=jsonp` returns 200
4. Double-URL-encode callback to inject JS: `&callback=alert%2528%2527xss%2527%2529%252F%252F&output=jsonp`
5. Open popup to /search (X-Frame-Options blocks iframe), postMessage `{"method":"APP.apiCall","arg":"&callback=<double-encoded>//&output=jsonp#"}`
6. Injected script fetches /profile with credentials to read csrftoken, then POSTs to /api/updateProfile?csrftoken=... to change username
**How found:** Stalled hunting CSRF on in-scope assets, pivoted to out-of-scope subdomains seeking trust relationships; used postMessage-tracker to spot listener lacking origin check, then enumerated window.APP functions for a script gadget, finding apiCall; fuzzed JSONP endpoint and noticed WAF bypass via malformed path and lenient double-encoded callback.
**Exploitation:** Victim authenticated on www.redacted.com clicks a button on attacker page; popup opens out-of-scope.redacted.com/search, postMessage triggers APP.apiCall to load attacker-controlled JSONP script executing in that origin; script uses CORS to read csrftoken from /profile and issues authenticated POST to /api/updateProfile, changing the victim's username.
**Escalation:** Out-of-scope XSS on any *.redacted.com subdomain combined with wildcard-subdomain CORS on /profile enabled token theft and CSRF against in-scope API.
**Insight:** When a postMessage listener dispatches to window.APP methods, enumerate APP functions for ones that build URLs or load scripts (apiCall-style JSONP loaders) rather than hunting eval; also test WAF bypass by replacing `?` with `&`/`#` so origin server still parses query params.