Stored XSS via Webhook Token Exposure in StoaChat

Executive Summary

This vulnerability affects stoatchat (delta/Revolt) versions from 20241213-1 before 20250210-1. Users with only ViewChannel (read) permission can fetch a channel's webhooks, including their tokens, because the endpoint incorrectly checked for ViewChannel instead of ManageWebhooks. Attackers can use these tokens to send arbitrary messages to the channel, bypassing permissions and impersonating bots or webhooks.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if users with ViewChannel permission can fetch webhook tokens in stoatchat (delta/Revolt) versions before 20250210-1. Review server logs for unauthorized webhook token access or messages sent via retrieved tokens. No specific commands are provided in the context.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to send fake messages in your channels, impersonate bots or webhooks, and potentially deceive users into taking harmful actions. This could lead to misinformation, phishing, or unauthorized access to sensitive discussions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized access to webhook tokens, which may allow attackers to send arbitrary messages to channels. This could lead to data breaches or unauthorized data exposure, violating confidentiality and integrity requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update stoatchat (delta/Revolt) to version 20250210-1 (0.8.2) or later to patch the vulnerability. Review and restrict ViewChannel permissions to prevent unauthorized webhook token access. Monitor channels for suspicious messages sent via webhooks.

Useful 0 Not Useful 0