✍️ Description

The Facebook notifications of livehelperchat fbmessenger extension can be modified listing new notifications. However, the template is used incorrectly resulting in a CSTI injection which leads to stored XSS.

🕵️‍♂️ Proof of Concept

Install the livechat

Install fbmessenger extension

Go on https://lhchost.com/site_admin/fbmessenger/notifications The attacker creates/changes the message and name with this payload: {{$on.constructor('alert(document.domain)')()}} When someone else visits the page aforementioned, a XSS is popped!

💥 Impact

This vulnerability is capable of injecting JS code permanently showed to every user

References:

https://github.com/LiveHelperChat/fbmessenger/blob/master/design/fbmessengertheme/tpl/lhfbmessenger/parts/form_notification.tpl.php

https://github.com/LiveHelperChat/fbmessenger/blob/master/design/fbmessengertheme/tpl/lhfbmessenger/notifications.tpl.php