CVE-2015-9545

An attacker hosts a malicious web page that the victim visits. The malicious page uses `postMessage` to send crafted messages to the target site's iframe (the xdLocalStorage bridge). Because `receiveMessage()` does not validate the origin of incoming messages [CWE-20], the attacker can read, write, or delete arbitrary local storage entries belonging to the vulnerable site. The attack requires only that the victim's browser loads the attacker's page while the target site's iframe is also present.

The vulnerable code is in the `receiveMessage()` function within `xdLocalStorage.js`. This function handles incoming `postMessage` events but performs no validation of the `event.origin` property, allowing any origin to send messages that are processed as legitimate storage operations.

No patch is included in the bundle. The advisory states that the `receiveMessage()` function in `xdLocalStorage.js` does not implement any validation of the origin of web messages. To remediate the issue, the library should check the `event.origin` property of incoming postMessage events against a whitelist of allowed origins before processing the message data.