Rewind: Storybook XSS → ATO via Cookie Toss
Target: plutonium.rewind.com (Rewind Storybook)
App: app.rewind.com (Rails/Devise)
Vector: postMessage → updateStoryArgs → anchor href → javascript: URL
Impact: 1-click XSS → cookie toss on .rewind.com → session fixation → ATO
Interaction: One click on the injected link
ATO Chain:
1. Attacker logs into Rewind → captures _rewind-app_session
2. Victim clicks the button → Storybook opens in popup
3. postMessage injects javascript: href into Anchor component
4. Victim clicks the link → JS sets _rewind-app_session=ATTACKER on Domain=.rewind.com
5. JS redirects victim to app.rewind.com → browser sends TOSSED cookie + REAL cookie
6. Rails reads first cookie → victim enters attacker's session
7. Victim logs in via OAuth (Google/GitHub) → attacker shares session = ATO
Click the button to start the attack chain