Executive brief
CleverTap Web SDK is a JavaScript library that customer websites embed to enable customer engagement features like visual campaigns. A DOM-based cross-site scripting (XSS) vulnerability in the SDK's Visual Builder module allows attackers to inject malicious JavaScript into web pages by bypassing the origin validation check. An attacker can craft a malicious postMessage that includes a crafted subdomain to bypass the origin check, then inject arbitrary HTML/JavaScript that executes in the context of the victim's website, potentially stealing user data or hijacking sessions.
Technical details
The vulnerability is a DOM-based cross-site scripting (XSS) flaw in the Visual Builder module of CleverTap Web SDK versions ≤ 1.15.2. The root cause lies in two flaws: (1) insufficient origin validation in src/modules/visualBuilder/pageBuilder.js (lines 56-60) that uses the String.includes() method to check if the origin contains "dashboard.clevertap.com", allowing bypass via crafted subdomains like "attacker.dashboard.clevertap.com"; and (2) unsanitized DOM manipulation where the renderVisualBuilder() function directly assigns user-controlled HTML to element.outerHTML without sanitization. An attacker can send a crafted postMessage event from any origin with a payload containing malicious HTML/JavaScript. The attack requires user interaction (opening a malicious page or link) but no authentication. The vulnerability is fixed in version 1.15.3.
Affected products
- CleverTap Web SDK ≤ 1.15.2
Timeline
- 2025-07-13: disclosed: Vulnerability reported on GitHub issue #442
- 2026-02-27: advisory: GHSA advisory published
- 2026-02-27: patched: Fixed in version 1.15.3