Booksy Business — DOM XSS (F1)

Sink: the push.open postMessage handler (no origin check, registered on every page load) reaches notificationAction, which calls window.open(target_id,"_blank") on a deeplink with no scheme check. A javascript: target executes in the bug-bounty.env.booksy.pm origin (no CSP).

Method A — guaranteed (console one-liner)

1. Open https://bug-bounty.env.booksy.pm/pro/en-pl/ and wait ~5s for it to load.
2. Open DevTools Console (F12).
3. Click once anywhere on the Booksy page (grants popup activation), then immediately paste and run:

window.postMessage(JSON.stringify({name:"push.open",data:{type:"deeplink",args:["javascript:alert('BOOKSY-XSS:'+document.domain)"]}}),"*")

alert('BOOKSY-XSS:bug-bounty.env.booksy.pm') fires in the Booksy origin (do the click and paste within ~5s of each other).

Method B — cross-origin attacker page (needs popups allowed)

Allow popups for this site first. Then:

A Booksy window opens and this page spams the push.open message. Click once anywhere inside the Booksy window — a second window opens and pops alert('BOOKSY-XSS:bug-bounty.env.booksy.pm') in the Booksy origin.