Unvalidated postMessage on support.innogames.com

The support chat widget's two message listeners never check the sender. This page sits on an unrelated domain and sends them two messages. The second reaches .sdk-button-text .innerHTML inside a document that inherits the support.innogames.com origin. That page's CSP sets script-src and nothing else, so with no form-action an injected form may post anywhere.

Three steps

1. Press the button. It opens the real knowledge base in a new tab. Leave this tab open.
2. In that tab, wait about five seconds and look bottom right. A red PROOF OF CONCEPT bar appears, pre-filled with dummy values. Change them if you like, keep them dummy, press Send. The address bar still reads support.innogames.com.
3. Come back here. What you typed appears below, read back from the collector it was sent to.

Open support.innogames.com and inject Re-inject

What you typed, received off-origin

your run id:

Activity