Description
Chatwoot before 4.14.0 contains a stored cross-site scripting vulnerability that allows account administrators to inject JavaScript by crafting video-embed links in Help Center articles. Attackers can use angle-bracket link destinations with double quotes to break out of the unescaped iframe src attribute in render_embed_from_match, executing scripts for public visitors and stealing cw_conversation widget tokens.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| chatwoot | chatwoot | < 4.14.0 | 4.14.0 |
References
- https://github.com/chatwoot/chatwoot/pull/14140 patch issue-tracking
- https://github.com/chatwoot/chatwoot/commit/2192af80f405c70e3021191ff8b3f7e539c35e9d patch
- chatwoot v4.14.0 Release Notes release-notes
- https://github.com/chatwoot/chatwoot/blob/88ffa329eb6e18ae06b608d8b4bab96c0e1b8f44/lib/custom_markdown_renderer.rb#L75-L84 technical-description
- VulnCheck Advisory: Chatwoot before 4.14.0 Stored XSS via Help Center Video Embed Links third-party-advisory