Medscape — 1-click Account Takeover
Target: www.medscape.com
Vulnerable component: Advertising postMessage handler
Origin check bypass: event.origin.indexOf("medscape") — this domain contains "medscape"
Sink: Function("return " + data.callBack) — CSP allows unsafe-eval
Impact: XSS → steal JWT + PII + demonstrate email change without password → ATO
Step 1: Open www.medscape.com/ in popup (where the vulnerable handler lives)
Step 2: postMessage with callBack → passes indexOf("medscape") → Function() executes
Step 3: Read PageMetadata.addProfile (embedded PII) + fetch("/profile") fallback
Step 4: Extract JWT from sessionStorage (direct or via hidden iframe)
Step 5: Demonstrate email change API needs no password → ATO path confirmed
Stolen Data & ATO Evidence