PT-2022-13131 · Remdex · Livehelperchat

Published 2022-01-27 · Updated 2022-02-02 · CVE-2022-0370

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions remdex/livehelperchat versions prior to 3.93v

Description The issue is related to Stored Cross-site Scripting (XSS) in the livehelperchat package. It is found in the Settings > Live help configuration > Personal Theme > static content section. An attacker can inject a payload, such as {{constructor.constructor('alert(1)')()}}, into the NAME field while creating content. This input gets stored and the payload is executed every time a user visits the affected page.

Recommendations For versions prior to 3.93v, update to version 3.93v or later to resolve the issue. As a temporary workaround, consider restricting access to the static content section in the Personal Theme settings to minimize the risk of exploitation. Avoid using the static content feature until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-0370

GHSA-8WCC-F2VQ-H4GX

Affected Products

Livehelperchat

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0370.json · Exploit
• 🔥 https://huntr.dev/bounties/fbe4b376-57ce-42cd-a9a9-049c4099b3ca · Exploit
• https://github.com/livehelperchat/livehelperchat/commit/9f5bc33c943349bd765b991db0b7f6b6ef05cfdb · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-0370 · Security Note
• https://osv.dev/vulnerability/GHSA-8wcc-f2vq-h4gx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-0370 · Vendor Advisory
• https://github.com/livehelperchat/livehelperchat · Note
• https://t.me/cibsecurity/36366 · Telegram Post
• https://t.me/cvenotify/25900 · Telegram Post
• https://t.me/cvenotify/25910 · Telegram Post
• https://t.me/cvenotify/26183 · Telegram Post