CVE-2022-1022 (Other, published 2022-04-21T15:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository chatwoot/chatwoot prior to 2.5.0.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/chatwoot/chatwoot
Files changed:
app/javascript/dashboard/components/widgets/conversation/ReplyBox.vue
app/javascript/dashboard/components/widgets/conversation/bubble/Text.vue
app/javascript/dashboard/modules/contact/components/MergeContactSummary.vue
app/javascript/dashboard/modules/notes/components/ContactNote.vue
app/javascript/dashboard/routes/auth/Signup.vue
app/javascript/dashboard/routes/dashboard/conversation/ContactCustomAttributes.vue
app/javascript/dashboard/routes/dashboard/conversation/search/SearchMessageItem.vue
app/javascript/dashboard/routes/dashboard/settings/SettingsSubPageHeader.vue
app/javascript/dashboard/routes/dashboard/settings/agents/Index.vue
app/javascript/dashboard/routes/dashboard/settings/attributes/CustomAttribute.vue
app/javascript/dashboard/routes/dashboard/settings/automation/Index.vue
app/javascript/dashboard/routes/dashboard/settings/canned/Index.vue
app/javascript/dashboard/routes/dashboard/settings/inbox/Index.vue
app/javascript/dashboard/routes/dashboard/settings/integrationapps/MultipleIntegrationHooks.vue
app/javascript/dashboard/routes/dashboard/settings/integrations/IntegrationHelpText.vue
app/javascript/dashboard/routes/dashboard/settings/integrations/Webhook.vue
app/javascript/dashboard/routes/dashboard/settings/labels/Index.vue
app/javascript/dashboard/routes/dashboard/settings/teams/Index.vue
app/javascript/packs/application.js
app/javascript/packs/widget.js
app/javascript/shared/components/emoji/EmojiInput.vue
app/javascript/widget/components/AgentMessageBubble.vue
app/javascript/widget/components/ChatHeader.vue
app/javascript/widget/components/ChatHeaderExpanded.vue
app/javascript/widget/components/UnreadMessage.vue
app/javascript/widget/components/UserMessageBubble.vue
package.json
yarn.lock
Commit message: chore: Sanitize html content  (#4498)



Vulnerable code:
        v-html="formatMessage(messageSignature)"
    <div class="text-content" v-html="message"></div>
          v-html="
          v-html="
    <p class="note__content" v-html="formatMessage(note || '')" />
          <p class="accept--terms" v-html="termsLink"></p>
        <span v-html="valueWithLink(customAttributes[attribute])"></span>
      <p class="message-content" v-html="prepareContent(content)"></p>
    <p class="small-12 column" v-html="headerContent"></p>
          v-html="
      <span v-html="$t('ATTRIBUTES_MGMT.SIDEBAR_TXT')"></span>
        <span v-html="$t('AUTOMATION.SIDEBAR_TXT')"></span>
        <span v-html="$t('CANNED_MGMT.SIDEBAR_TXT')"></span>
          v-html="
        v-html="
          <span v-html="$t('INTEGRATION_SETTINGS.SLACK.HELP_TEXT.BODY')"></span>
          v-html="
        <span v-html="$t('LABEL_MGMT.SIDEBAR_TXT')"></span>
          v-html="

            v-html="emojis[category][0]"
        v-html="emoji"
        v-html="formatMessage(message, false)"
          <span class="mr-1" v-html="title" />
      class=" mt-5 text-3xl mb-3 font-normal"
      v-html="introHeading"
      v-html="introBody"
      <div class="message-content" v-html="formatMessage(message, false)"></div>
    v-html="formatMessage(message, false)"

Fixed code:
        v-dompurify-html="formatMessage(messageSignature)"
    <div v-dompurify-html="message" class="text-content"></div>
          v-dompurify-html="
          v-dompurify-html="
    <p v-dompurify-html="formatMessage(note || '')" class="note__content" />
          <p v-dompurify-html="termsLink" class="accept--terms"></p>
        <span
          v-dompurify-html="valueWithLink(customAttributes[attribute])"
        ></span>
      <p v-dompurify-html="prepareContent(content)" class="message-content"></p>
    <p v-dompurify-html="headerContent" class="small-12 column"></p>
          v-dompurify-html="
      <span v-dompurify-html="$t('ATTRIBUTES_MGMT.SIDEBAR_TXT')"></span>
        <span v-dompurify-html="$t('AUTOMATION.SIDEBAR_TXT')"></span>
        <span v-dompurify-html="$t('CANNED_MGMT.SIDEBAR_TXT')"></span>
          v-dompurify-html="
        v-dompurify-html="
          <span
            v-dompurify-html="$t('INTEGRATION_SETTINGS.SLACK.HELP_TEXT.BODY')"
          ></span>
          v-dompurify-html="
        <span v-dompurify-html="$t('LABEL_MGMT.SIDEBAR_TXT')"></span>
          v-dompurify-html="
import VueDOMPurifyHTML from 'vue-dompurify-html';
Vue.use(VueDOMPurifyHTML);
import VueDOMPurifyHTML from 'vue-dompurify-html';
Vue.use(VueDOMPurifyHTML);
            v-dompurify-html="emojis[category][0]"
        v-dompurify-html="emoji"
        v-dompurify-html="formatMessage(message, false)"
          <span v-dompurify-html="title" class="mr-1" />
      v-dompurify-html="introHeading"
      class="mt-5 text-3xl mb-3 font-normal"
      v-dompurify-html="introBody"
      <div
        v-dompurify-html="formatMessage(message, false)"
        class="message-content"
      ></div>
    v-dompurify-html="formatMessage(message, false)"
    "vue-dompurify-html": "^2.5.1",
dompurify@^2.3.4:
  version "2.3.6"
  resolved "https://registry.npmjs.org/dompurify/-/dompurify-2.3.6.tgz#2e019d7d7617aacac07cbbe3d88ae3ad354cf875"
  integrity sha512-OFP2u/3T1R5CEgWCEONuJ1a5+MFKnOYpkywpUSxv/dj1LeBT1erK+JwM7zK0ROy2BRhqVCf0LRw/kHqKuMkVGg==

vue-dompurify-html@^2.5.1:
  version "2.5.1"
  resolved "https://registry.npmjs.org/vue-dompurify-html/-/vue-dompurify-html-2.5.1.tgz#a754f4ac7b18eb8fe41f461cb2bb1c4956a9bd2d"
  integrity sha512-B8rQj2jAPJJhtKHHa6jg5B3/RoKBmmUl/awP/GxWXGu75j4Y7+MHqv0DG52v0Uz0taEpHyZun34KEYMAfrPWnA==
  dependencies:
    dompurify "^2.3.4"