Attack Chain
Source → Sink Flow
Source —
window.addEventListener("message", handleIframeMessage)airo-sentinel loader registers a postMessage listener on every page it loads. Accepts messages from t.origin and t.data — both fully attacker-controlled.
Gate 1 (bypassed) —
j(t.origin) — Broken regex allowlist
Checks origin against /^https:\/\/([\w-]+\.)*(test-)*(dev-)*godaddy\.com$/
This domain passes because (test-)* matches
This domain passes because (test-)* matches
test- and (dev-)* matches dev-dev- (two repetitions), making the TLD godaddy.com of this domain satisfy the check.
Gate 2 (bypassed) —
if (sender !== "airo-hq") returnChecks t.data.sender. Bypassed by including sender: "airo-hq" in the message payload — this is data we control, not a cryptographic token.
Router —
switch(action) → case "navigate"The action field in our payload is set to "navigate", routing execution to the
H() function with t.data.value.data as the argument.Sink —
H({path, absolute:true}) → window.open(new URL(path), "_self")
With absolute: true, the function calls new URL(path) with no base — this allows
javascript: URLs. Then window.open(jsURL, "_self") executes our code in the GoDaddy page context, with full access to cookies, localStorage, and session tokens.
Regex Breakdown
Why the regex fails
^https://
([\w-]+\.)*
matches "www."
(test-)*
matches "test-"
(dev-)*
matches "dev-dev-"
godaddy\.com$
matches TLD of this domain
https://hub.godaddy.com
Legitimate — passes correctly
https://www.godaddy.com
Legitimate — passes correctly
loading...
This domain — passes (regex bypass)
https://test-dev-godaddy.com
Attacker variant — also passes
https://evil.com
Blocked correctly
Target & Action
Select Target Domain
hub.godaddy.com
GoDaddy Pro Hub
dashboard.godaddy.com
Main Dashboard
dcc.godaddy.com
Domain Control Center
productivity.godaddy.com
Email & Office
sso.godaddy.com
Single Sign-On
pro.godaddy.com
GoDaddy Pro
Select Payload
Live Log
✅ Execution confirmed — data received from target
Domain
—
URL
—
Cookies
—
localStorage
—