Executive brief
CleverTap Web SDK is a JavaScript library that customer websites embed to enable analytics and in-app messaging campaigns. A flaw in its message handler allows attackers to inject malicious JavaScript code that executes in the context of any website using the SDK, potentially stealing session cookies, performing unauthorized actions on behalf of users, or defacing web pages. The vulnerability requires user interaction (loading a malicious page) but affects all websites using vulnerable SDK versions.
Technical details
The vulnerability is a DOM-based Cross-Site Scripting (XSS) flaw in the handleCustomHtmlPreviewPostMessageEvent function in nativeDisplay.js. The SDK listens for window.postMessage events and unsafely injects the display.details[0].html field directly into the page DOM via innerHTML without proper sanitization. Although version 1.15.2 introduced an origin check, it uses the string.includes() method to validate event.origin against "clevertap.com", which can be bypassed by attacker-controlled subdomains (e.g., dashboard.clevertap.attacker.com). An attacker can craft a malicious postMessage payload embedding arbitrary HTML/JavaScript (e.g., img onerror handlers) that executes when rendered. Fix: Update to version 1.15.3 or later, which implements proper origin validation.
Affected products
- CleverTap Web SDK 1.15.2 and earlier
Timeline
- 2026-02-27: disclosed: Vulnerability published in NVD and GitHub Advisory
- 2026: patched: Fix released in version 1.15.3