Swiss Post Storybook DOM XSS PoC

Target: next.design-system.post.ch (Swiss Post design system Storybook)
XSS type: DOM XSS via javascript: URL in Logo component's url prop (updateStoryArgs + forceRemount)
Interaction: 1 click — click the Swiss Post logo inside the Storybook popup
Impact chain: XSS → cookie tossing to .post.ch → credential phishing on trusted domain → automated login & account data extraction (ATO)
Note: CSP blocks connect-src to external hosts, so the entire payload is inlined in the javascript: URL. document.write and postMessage are unaffected.

Swiss Post Storybook DOM XSS — Full ATO Chain

Data Exfiltrated (on click)

Credentials Captured (trusted domain phishing)

Account Takeover — Extracted Account Data