PoC: OAuth authorization code leak via postMessage targetOrigin '*'


Target: https://developers.sber.ru/portal/auth
Attacker page: https://poc.78-17-98-39.sslip.io/
Collector: https://oob.78-17-98-39.sslip.io/STOLEN-OAUTH-CODE
Researcher: riptacol

This page is hosted on an unrelated third-party host. It opens the legitimate Sber ID login flow in a popup. The callback page at developers.sber.ru sends its query string, containing the authorization code and state, to window.opener with targetOrigin '*', so this page receives it and forwards it to the attacker collector.



not executed yet