CVE-2022-21830: Cross-site Scripting in @rocket.chat/livechat
Summary
CVE-2022-21830: Cross-site Scripting in @rocket.chat/livechat. Affects @rocket.chat/livechat versions < 1.9.0. Fixed in 1.9.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @rocket.chat/livechat package is an npm package used for implementing live chat functionality in RocketChat applications. It allows users to engage in real-time conversations with website visitors. This package is vulnerable to a blind self XSS vulnerability in versions lower than 1.9. This vulnerability enables an attacker to trick a victim into pasting malicious code in their chat instance.
Vulnerability Detail
The blind self XSS vulnerability in @rocket.chat/livechat versions lower than 1.9 allows an attacker to exploit the trust between users by tricking them into pasting malicious code into their chat instance. This can lead to the execution of arbitrary JavaScript code in the victim's browser, potentially compromising their sensitive information or performing unauthorized actions on their behalf. The vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
Minimum fixed version
1.9.0
This is the first release that contains the fix.
npm install @rocket.chat/livechat@1.9.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version as soon as possible to ensure the security of the application.
Conclusion
In conclusion, the @rocket.chat/livechat package is vulnerable to a blind self XSS vulnerability in versions lower than 1.9. It is crucial to update to version 1.9.0 or higher to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for @rocket.chat/livechat →
FAQ
The vulnerability allows an attacker to execute arbitrary JavaScript code in the victim's browser, potentially compromising their sensitive information or performing unauthorized actions on their behalf.
Versions lower than 1.9 of the @rocket.chat/livechat package are affected by this vulnerability.
No, there is no known workaround for this vulnerability. It is essential to update to the fixed version to mitigate the risk.
You can update the package by running the following command: npm install @rocket.chat/livechat@1.9.0
You can find more information about this vulnerability in the GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/04/GHSA-hf55-c445-2w97/GHSA-hf55-c445-2w97.json
