Proof of concept · Amdocs

Any website can run script as the Product Documentation portal

The Document viewer accepts a postMessage from any origin and passes event.data.url to Angular's sanitizer bypass, so a page on an unrelated domain chooses what loads into the portal — and reads that origin's cookie jar.

https://docs.product-uat.misnp.amdocs.com/document

What happens when you press the button

  1. This page opens the portal's /document route in a new window.
  2. Your existing session renders it, and the Document module registers its message handler.
  3. This page posts {url: "javascript:…"} at that window. The handler never checks event.origin, so it accepts it.
  4. The handler passes the value to bypassSecurityTrustResourceUrl() and binds it to #myIframe's src, which executes it in the portal's own origin.
  5. That script reads document.cookie and sends the result back here for display.

Run it

idle

Sign in to the portal first, in this same browser. The script then reads your own live AccessKeyId, SecretAccessKey, SessionToken and open_id_token — the four values the portal's setLoginCredentials() writes with document.cookie, which is why none of them can be HttpOnly. Without a session it writes a marker into any of those cookies that is absent and reads that back instead, so the read path still demonstrates. Everything is displayed on this page and sent nowhere.

Returned from inside the portal origin

Nothing yet. Press "Run the proof".