CleverTap Web SDK XSS via Unsanitized postMessage

Executive Summary

CleverTap Web SDK v1.15.1 is vulnerable to Cross Site Scripting (XSS). The application fails to sanitize untrusted data received via window.postMessage before injecting it into the page DOM. An attacker can send a malicious message that, when processed by the renderCustomHtml function, executes arbitrary JavaScript in the context of the hosting site.

Useful 0 Not Useful 0

Detection Guidance

To detect this XSS vulnerability in CleverTap Web SDK v1.15.1, inspect network traffic for postMessage events containing untrusted data. Check if renderCustomHtml processes messages without sanitization. Use browser developer tools to monitor DOM changes and look for injected scripts.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to execute arbitrary JavaScript in the context of your website. This could lead to theft of sensitive user data, session hijacking, defacement of your website, or redirection to malicious sites. Users interacting with the affected site may have their data compromised without their knowledge.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to violations of GDPR and HIPAA by exposing personal or health data to unauthorized parties. GDPR requires protection of user data, and HIPAA mandates safeguards for protected health information. A breach via XSS could result in legal penalties, fines, and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade to a patched version of CleverTap Web SDK beyond v1.15.1. If upgrading is not possible, implement input validation for postMessage events and sanitize all dynamic content before DOM insertion. Disable the renderCustomHtml function if unused.

Useful 0 Not Useful 0