https://blog.rodolpheg.xyz/tags/bug-bounty/Recent content in Bug Bounty on RORO's blogHugoencontact@rodolpheg.xyz (0xRo)contact@rodolpheg.xyz (0xRo)Sun, 10 May 2026 00:00:00 +0000https://blog.rodolpheg.xyz/posts/dom-xss-postmessage-bug-bounty/Sun, 10 May 2026 00:00:00 +0000contact@rodolpheg.xyz (0xRo)https://blog.rodolpheg.xyz/posts/dom-xss-postmessage-bug-bounty/<blockquote> <p><strong>Disclosure notice</strong>: Scope, program name, and company identity are redacted per responsible disclosure policy. All code samples are either anonymized or reconstructed to illustrate the concept. The vulnerability was reported through a bug bounty platform and has since been remediated.</p> </blockquote> <hr> <h2 id="tldr">TL;DR</h2> <ul> <li>Found a DOM-based XSS in a <code>/apps/returns</code> page of a major e-commerce brand</li> <li>Root cause: <code>window.location.href = event.data.data</code> - no origin check, no scheme validation</li> <li>Attack vector: any cross-origin window holding a reference via <code>window.open()</code> can deliver a <code>javascript:</code> URI</li> <li>Impact: full JavaScript execution in the target origin → session cookies, localStorage, same-origin API calls, account takeover</li> <li>CVSS 9.0</li> <li>Bonus: discovered a CSRF-less address destruction chain while exploring the impact</li> </ul> <hr> <h2 id="how-it-started">How it started</h2> <p>I was hunting on a major beauty e-commerce brand running on Shopify. Nothing fancy - just reading the page source, grepping for interesting patterns, looking for that one thing someone forgot to validate.</p>