# Bypassing Digits origin validation which leads to account takeover

Digits SDK validated postMessage origin with String.search() treating attacker origin as regex, so www.d.gits.co matched www.digits.com and enabled account takeover.

- Payout: hidden
- Severity: high
- Program: X / xAI
- Found by: filedescriptor
- Disclosed: 2020-06-24
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/129873
- Library page: https://bugbountylibrary.com/r/h1%3A129873
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:high technique:source-review vuln:account-takeover vuln:auth-bypass

**Target:** JavaScript SDK postMessage origin validation (cdn.digits.com/1/sdk.js)
**Root cause:** Origin check used `"https://www.digits.com".search(t.origin)`, implicitly converting the attacker-controlled origin string into a regex where dots are wildcards, so a crafted domain matched the legit origin.
**Steps:**
1. Read sdk.js onReceiveMessage: `-1 !== this.config.get("sdk_host").search(t.origin)`
2. Note t.origin is coerced to a RegExp; `.` in domain acts as wildcard
3. Register domain `www.d.gits.co` whose regex matches `www.digits.com`
4. Host page at `https://www.d.gits.co/fabric.html` that postMessages to the Fabric window
5. Victim logged into Fabric.io visits page and clicks button; phone number silently associated with attacker
6. Attacker uses Digits password reset to take over the account
**How found:** Code review of the Digits SDK's postMessage handler; noticed String.prototype.search() takes a regex, not a string, and that the origin string was passed directly, making dots wildcards.
**Exploitation:** Attacker-controlled origin page sends postMessage commands accepted by the Digits SDK on the victim site, letting the attacker bind their phone number to the victim's account, then abuse Digits password reset for takeover; silent, no user awareness beyond a click.
**Insight:** When auditing postMessage handlers, check whether origin comparison uses search/match/indexOf/endsWith incorrectly — passing the untrusted origin as a regex or substring lets attacker domains like `www.d.gits.co` satisfy `www.digits.com` checks.