Zenvia Movidesk Cross-Site Scripting Vulnerability in New Ticket Handler Component

A stored cross-site scripting vulnerability has been identified in Zenvia Movidesk versions prior to 25.01.22. This issue affects the New Ticket Handler component, where the 'subject' argument can be manipulated to inject malicious scripts. The vulnerability can be exploited remotely and requires user interaction.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Reproduction

To reproduce this vulnerability, create a new ticket in Zenvia Movidesk version prior to 25.01.22.245a473c54. In the 'subject' field, enter a script injection payload, such as an image tag with an 'onerror' event. Once the ticket is saved, the injected script will execute when the ticket is viewed.

Remediation

Users are advised to upgrade to Zenvia Movidesk version 25.01.22.245a473c54 or later.