flowmusic.app — DOM XSS → Account Takeover

Zero-click. Opening this page is the entire attack (victim must be signed in to flowmusic.app).

Firing… this window will navigate to www.flowmusic.app, execute injected JS on that origin, steal the session, call the app API as the victim, and exfiltrate the tokens.

Query parameters

?webhook=Collector the stolen tokens are POSTed to. Accepts a bare webhook.site UUID (49d8f628-44f6-463c-a6a9-c4b31cbb16f2), a full https://webhook.site/<uuid> URL, or any absolute https:// URL. Optional — falls back to the built-in default below.

Active collector: …

  1. Sink: /auth passes router.query.redirectUrl to router.replace(); Next.js isLocalURL("javascript:…") is false → handleHardNavigation runs window.location.href = <attacker string> with no scheme check.
  2. WAF evasion: the payload lives in window.name (persists across the top-level navigation), so the request URL is only ?redirectUrl=javascript:name.
  3. Impact: the non-HttpOnly 400-day sb-sb-auth-token.* cookie is read by the injected JS, tokens exfiltrated, and /__api/users/me is called as the victim.
  4. Verification: feed the exfiltrated JSON to tools/ato-verify.mjs to build the Caido Replay tabs that exercise the stolen tokens against the live API.