CVE-2015-9544

An attacker hosts a malicious web page that embeds or communicates with the victim site's xdLocalStorage iframe via the HTML5 postMessage API. Because receiveMessage() in xdLocalStoragePostMessageApi.js does not validate the origin of incoming messages [CWE-20], the attacker can send crafted messages that read, write, or delete arbitrary localStorage entries on the victim domain. The attack requires luring a user who has the vulnerable site open (or whose browser has the iframe loaded) to also visit the attacker's page.

The vulnerable function is receiveMessage() in xdLocalStoragePostMessageApi.js [ref_id=1]. The library's GitHub repository shows this file handles all incoming postMessage events for the cross-domain localStorage iframe, but the advisory states it "does not implement any validation of the origin of web messages."

No patch is included in the bundle. The advisory [ref_id=1] describes the library's architecture but does not provide a fix commit. The remediation is to add origin validation inside receiveMessage() — the function should check event.origin against a whitelist of allowed domains before processing any postMessage data. Without such validation, any origin can impersonate trusted frames and manipulate localStorage contents.