Malicious JavaScript Payload in VaahCMS Email Templates

Executive Summary

This vulnerability involves a hidden malicious JavaScript code embedded in the email template for security OTP messages in VaahCMS versions 2.0.0 through 2.3.4. When the email is opened in a browser with JavaScript enabled, the payload activates and connects to a hardcoded command-and-control server. It can then install a keylogger to capture passwords, steal WhatsApp Web content, and execute remote commands to redirect or modify the page.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking for the malicious JavaScript payload in VaahCMS email templates. Inspect the Blade template responsible for rendering security OTP emails for obfuscated JavaScript code. Look for WebSocket connections to hardcoded command-and-control endpoints and keylogger scripts using MutationObserver.

Useful 0 Not Useful 0

Impact Analysis

If you use VaahCMS versions 2.0.0 to 2.3.4, attackers could gain unauthorized access to your system through email OTP templates. They may steal sensitive data like passwords or WhatsApp messages, redirect you to malicious sites, or take control of your browser session without your knowledge.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles or HIPAA's safeguards for protected health information. Organizations using affected versions may face compliance breaches, legal penalties, and reputational damage due to potential data leaks.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update VaahCMS to a version beyond 2.3.4. Remove the malicious JavaScript payload from the Blade template for security OTP emails. Block network connections to any hardcoded command-and-control endpoints identified in the payload. Monitor for unauthorized WebSocket connections or suspicious DOM modifications.

Useful 0 Not Useful 0