T08 · Insecure Dependencies
Warning
- Location
assets/index.html:8- Finding
Mutable Third-Party JavaScript Can Access Dashboard Tokens and Sensitive Email Data
- Content
View full analysis
``` ```javascript const urlToken = new URLSearchParams(window.location.search).get('token'); if (urlToken) { localStorage.setItem('dashboard-token', urlToken); window.history.replaceState({}, document.title, window.location.origin + window.location.pathname); } const token = localStorage.getItem('dashboard-token'); ``` ```javascript const eRes = await fetch('/api/emails', { headers: { 'X-Dashboard-Token': token } }); ``` ```javascript const sRes = await fetch('/api/session', { headers: { 'X-Dashboard-Token': token } }); ``` ### Technical Analysis The page executes a versionless JavaScript resource from `cdn.tailwindcss.com`. This script runs with the full privileges of the dashboard origin. It can therefore: - Read the dashboard token from the initial URL before it is removed. - Read the token retained in `localStorage`. - Intercept or modify `fetch` calls. - Make authenticated same-origin requests to `/api/emails` and `/api/session`. - Read email data already rendered into the DOM. - Transmit collected information to an external destination. Because the CDN script is fetched at runtime and is not pinned or protected with Subresource Integrity, its effective behavior can change after the Skill has been reviewed. A compromise of the CDN, its delivery chain, or the externally hosted script could consequently compromise the dashboard. The flagged requests at lines 85 and 113 are themselves necessary same-origin requests for the declared dashboard functionality. They do not directly exfiltrate information. The security issue is that the remote script shares their execution context and can access their authenticat ...[truncated 1271 chars]- Remediation
View remediation