Swiss Post Storybook DOM XSS PoC

Target: next.design-system.post.ch (Swiss Post design system Storybook)
Main app: account.post.ch / www.post.ch
XSS type: DOM XSS via javascript: URL in Link component's href prop (updateStoryArgs)
Interaction: 1 click — click the injected link inside the Storybook popup
Impact chain:
  Phase 1 (on click) — XSS fires, reads .post.ch cookies + localStorage
  Phase 2 (on click) — Cookie tossing: sets attacker-controlled cookies on .post.ch domain, visible to all *.post.ch services
  Phase 3 (on click) — Replaces page with fake Swiss Post login form on trusted *.post.ch domain
  Phase 4 (1 more interaction) — Credential capture on trusted domain

Swiss Post Storybook DOM XSS — Cookie Tossing & Credential Phishing

Data Exfiltrated (on click)

Credentials Captured (trusted domain phishing)