Chaining postMessage XSS on active24.cz

I manage a few websites and domains with the hosting provider active24.cz, one time I decided to take a closer look at their security. After a while of fiddling around I noticed a bunch of postMessages flowing between support.active24.cz and active24.cz origins every time the page was loaded, it was the live support chat system they were using. The main page was iframing https://support.active24.cz/scripts/generateWidget.php and then included a script to communicate with it, handing over information like user ID, if the user is logged in etc. Read more...