CVE-2022-0526: Cross-site Scripting (XSS) - Stored in chatwoot

Title

Stored XSS in custom_attributes

Description

Relying on frontend URI check without verifying it on the backend allows to inject arbitrary JS code.

Steps to reproduce

1. 1. Create a custom attribute, set its type to Link

2. 2. Navigate to any conversation, click on the right sidebar.

3. 3. Add a custom attribute, set its value to any valid URI.

4. 4. While intercepting traffic save a new value, observe an outcoming request to /api/v1/accounts/2/conversations/1/custom_attributes

5. 5. In POST request’s body use something like:

   { "custom_attributes":{ "{yourAttributesName}":"javascript:alert(document.domain)" } }

6. 6. Click on the link, trigger an XSS.

Note: it works in Safari and Firefox, not Chrome

Proof of Concept

Video PoC

Impact

This vulnerability is capable of running arbitrary JS code.