Private bug-bounty evidence
Arbitrary-origin postMessage bridge
Sanitized evidence for a confirmed client-side trust-boundary failure in LIVE Backstage. This page contains no credentials, DOM content, personal data, callback URL, or code that contacts the affected application.
Validated impact
- Status
- Confirmed
- Primitive
- Same-origin JavaScript execution in the victim's active Backstage session
- User action
- Victim visits an attacker-controlled page while signed in
- Persistence
- No independent attacker login was demonstrated
Confirmed routes
/portal/administration/contract/portal/administration/staff
Sanitized validation evidence
Two-stage isolated demonstration
This local mock illustrates the trust failure without loading or communicating with TikTok. The receiver deliberately accepts a message without authenticating its sender.
Stage 1 — execution signal
Waiting for stage 1…
Stage 2 — impact simulation
Complete stage 1 first.
Root cause and fix
The affected bridge treats an empty origin allowlist as permission for every origin, then accepts recorder configuration from the untrusted sender. Require an exact origin and source-window match, fail closed when the allowlist is empty, and remove message-controlled script input.