Executive brief
Rocket.Chat Livechat is a customer messaging widget deployed on websites to facilitate live support conversations. A cross-site scripting vulnerability in versions before 1.9 allows an attacker to inject malicious code that executes in a victim's browser, potentially stealing session credentials or performing unauthorized actions on their behalf when they paste crafted content in the chat interface.
Technical details
This is a stored/blind self-XSS vulnerability (CWE-79) in Rocket.Chat Livechat versions below 1.9. The vulnerable component is the message composer, which fails to properly sanitize user input before rendering it. An attacker can craft malicious JavaScript and trick a victim into pasting it into their own chat instance; when submitted, the unsanitized payload executes in the victim's browser with their privileges. The attack requires user interaction (pasting and submitting the malicious content) but no authentication. The fix, merged in PR #558, adds input sanitization to prevent XSS execution. The vulnerability was patched in version 1.9.0.
Affected products
- Rocket.Chat Livechat <1.9.0
Timeline
- 2022-04-03: disclosed: Advisory published
- 2022-03-16: patched: Fix merged in PR #558; released in v1.9.0