Frogman Stored Cross-Site Scripting Vulnerability in Chat Console Markdown Formatter

A stored cross-site scripting vulnerability has been identified in Frogman versions prior to 1.6.6. The issue arises in the chat console's markdown formatter, which improperly inserts user-controlled data as raw HTML in several template patterns, including inline code, bold text, markdown links, and download links. This flaw allows the injection of HTML/JavaScript payloads that execute in the session of any admin viewing the response through Frogman chat. The vulnerability exploits a lack of proper escaping in user-generated content, contrasting with FreePBX's admin GUI, which correctly sanitizes these fields. As a result, tool responses reflecting user-controlled data, such as extension names and ring-group descriptions, could trigger the execution of injected scripts when accessed by other admins via Frogman chat.

Impact

Exploitation of this vulnerability leads to stored cross-site scripting, where injected scripts are executed in the context of the viewer's session and permissions.

Reproduction

To reproduce this vulnerability, an admin with write access can inject a script payload into a user-controlled field, such as an extension name. Once the payload is injected, another admin must view the response through Frogman chat, triggering the execution of the script in their session.

Remediation

Users should update to Frogman version 1.6.6, which patches the vulnerability by ensuring that all regex captures are properly escaped before being inserted into the chat formatter. Additionally, download link URLs are now checked against a whitelist to block potentially harmful schemes.