MEDIUM5.4

GHSA-8wcc-f2vq-h4gx

Cross-site Scripting in livehelperchat

Quick fix

GHSA-8wcc-f2vq-h4gx — remdex/livehelperchat: upgrade to the fixed version with the command below.

composer require remdex/livehelperchat:^3.93

Details

Stored XSS is found in Settings>Live help configuration>Personal Theme>static content. Under the NAME field put a payload {{constructor.constructor('alert(1)')()}} while creating content, and you will see that the input gets stored, and every time the user visits, the payload gets executed.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/remdex/livehelperchat

Introduced in: 0Fixed in: 3.93

Fixcomposer require remdex/livehelperchat:^3.93

References

https://nvd.nist.gov/vuln/detail/CVE-2022-0370[ADVISORY]
https://github.com/livehelperchat/livehelperchat/commit/9f5bc33c943349bd765b991db0b7f6b6ef05cfdb[WEB]
https://github.com/livehelperchat/livehelperchat[PACKAGE]
https://huntr.dev/bounties/fbe4b376-57ce-42cd-a9a9-049c4099b3ca[WEB]