Executive brief
CleverTap's Cordova plugin enables mobile applications to interact with the CleverTap customer engagement platform. A flaw in the plugin's deeplink processing allows attackers to inject and execute arbitrary JavaScript code in affected applications when users open malicious deeplinks, potentially leading to credential theft, unauthorized actions, or malware installation.
Technical details
The vulnerability is a reflected Cross-Site Scripting (XSS) flaw (CWE-79) in CleverTap Cordova Plugin version 2.6.2 and earlier. The plugin fails to properly validate and sanitize data extracted from deeplinks before using it in JavaScript execution contexts. An attacker can craft a specially formed deeplink that, when opened by a user in an application using the vulnerable plugin, will execute arbitrary JavaScript with the privileges of the application. No authentication is required; the attack requires only that a user click a malicious link. The vulnerability was fixed in version 2.7.0.
Affected products
- CleverTap Cordova plugin 2.6.2 and earlier; fixed in 2.7.0
Timeline
- 2023-07-15: disclosed
- 2023: patched: Version 2.7.0 released