Asana Storybook DOM XSS → PII Theft + Cookie Tossing + Session Disruption

Target: storybook.asana.com (Asana design-system Storybook)
Main app: asana.com (Bugcrowd)
XSS type: DOM XSS via postMessage → updateStoryArgs → Customer Card customerPage prop = javascript:
Sink: Component onClick handler calls window.location.assign(customerPage) with raw prop value. React blocks the href attribute (throw new Error) but onClick still fires.
Interaction: 1 click — victim clicks the customer card in the popup
Impact chain:
  1. PII theft — steals user ID, tracking UUID, Google auth state, GA ID, account metadata from .asana.com cookies
  2. Cookie tossing — writes attacker-controlled cookies to .asana.com parent domain (no __Host- prefix protection). Shadows the ticket cookie used as CSRF token (x-asana-ticket header = double-submit cookie pattern)
  3. Session disruption — duplicate ticket cookie causes app.asana.com API to return 401 Not Authorized — confirmed DoS of authenticated session