Search code examples
javascriptsecurityiframexsscsrf

Can a parent domain capture input from a foreign iframe?

My team helps manage several ecommerce stores. We've always used Recurly for billing.

I noticed that they implement a strange security method: each form input is enclosed in an iframe on Recurly's domain. In each iframe, there is a unique token. When a user submits the final order form, all the information is grouped back together on the backend.

Naturally, I've been trying to think of ways to break this, to better secure our clients. At first, I thought it would be trivial to circumvent, but I am stumped.

Is there any way someone with code-execution on our clients' servers, can capture the payment data, through the iframes?

Solution

  • Well if you have access to the server, you could setup a proxy server and conduct a man in the middle attack to get the data. G