Introduction

During the security assessment of a large insurance company's partner extranet, I identified a reflected Cross-Site Scripting (XSS) vulnerability affecting the authentication endpoint.

Although the application implemented several defensive mechanisms—including server-side input normalization, HTML encoding, Content Security Policy (CSP), and clickjacking protections—it was possible to bypass all of them simultaneously and achieve arbitrary JavaScript execution.

Because the vulnerable page embeds the login form inside a same-origin iframe, the XSS could modify the authentication workflow and transparently redirect submitted credentials to an attacker-controlled endpoint, resulting in complete account takeover.