Khan Academy · Report #103989
Escaping the iframe via exceptions
Validstatus
29 Dec 2015disclosed
Summary
Several variations on an XSS in the CS platform, involving throwing a malformed error that caused the error buddy to interpret user-provided data as HTML. We now make sure to sanitize all of the messages passed from the iframe before using them.
How it was found
You can throw an object with an html property to run arbitrary js
Here is an example program that modifies a user's profile. I made the program as private as possible by saving it with nouser and drawing nothing in the hopes that it will be ignored, but if you want me to delete it, I will. The program will change your bio, so if you don't want that to happen, log out first.