Libredesk has Improper Neutralization of HTML Tags in a Web Page
Date: 2025-12
Affected: go/github.com/abhinavxd/libredesk
Attack vector: phishing
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2025-68927
CWE: CWE-79

### Summary LibreDesk is vulnerable to **stored HTML injection** in the contact notes feature. When adding notes via `POST /api/v1/contacts/{id}/notes`, the backend automatically wraps user input in `<p>` tags. However, by intercepting the request and removing the `<p>` tag, an attacker can inject arbitrary HTML elements such as forms and images, which are then stored and rendered without proper sanitization. This can lead to phishing, CSRF-style forced actions, and UI redress attacks. --- ### Details When notes are added through the LibreDesk web application, the client sends note content wrapped inside `<p>` tags. The backend appears to **trust this HTML structure** and stores the content as-is. By intercepting the request to: ``` POST /api/v1/contacts/3/notes ``` and **removing the `<p>` wrapper**, an attacker can submit arbitrary HTML content. The backend does not sanitize or validate the HTML payload before persisting it. As a result: * Arbitrary HTML tags (e.g., `<form>`, `<input>`, `<img>`) are stored * The injected HTML is rendered when the notes are viewed in the application * No server-side HTML sanitization or allowlisting is enforced This indicates that the application relies on **client-side HTML formatting assumptions**, which can be bypassed by modifying the request. --- ### PoC 1. Log in to LibreDesk and open any contact. 2. Add a note normally via the UI. 3. Intercept the request to: ``` POST /api/v1/contacts/3/notes ``` 4. Original req


Mitigations:

Architectural layers (MAESTRO):