CleverTap Web SDK Cross-Site Scripting Vulnerability via PostMessage

A cross-site scripting (XSS) vulnerability has been identified in CleverTap Web SDK versions through 1.15.2. The issue arises in the 'handleCustomHtmlPreviewPostMessageEvent' function, which fails to properly validate the origin of messages received via 'window.postMessage'. This lack of validation allows attackers to inject malicious HTML that is executed as JavaScript in the context of the user's browser.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can execute arbitrary JavaScript in the context of the affected user.

Reproduction

To reproduce this vulnerability, send a message through 'window.postMessage' from a malicious origin that includes untrusted HTML. The CleverTap Web SDK will process this message and inject the HTML into the DOM without proper sanitization, executing any embedded JavaScript.

Remediation

Users can upgrade to CleverTap Web SDK version 1.15.3 or later, where this vulnerability has been fixed.