Cross-site Scripting (XSS) - Stored in livehelperchat/livehelperchat

Vulnerability

The vulnerability is a stored cross-site scripting (XSS) issue in Live Helper Chat (LHC) prior to version 3.93v. The flaw is located in the lhc_web/design/defaulttheme/tpl/pagelayouts/parts/ template, specifically in the user box that displays the operator's name and surname. The code uses htmlspecialchars() to escape the output, but due to the lack of ng-non-bindable attribute on the anchor element, AngularJS expressions can be evaluated, leading to XSS. This affects all versions before 3.93v [1][2].

Exploitation

An attacker with the ability to modify their own name or surname (e.g., via profile settings) can inject AngularJS expressions or JavaScript code. When the name/surname is rendered in the user box of any page, the injected script executes in the context of the victim's browser visiting the affected page. No additional user interaction beyond viewing the page is required [3][4].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the browser of any user (including administrators) who views a page containing the affected user box. This can lead to session hijacking, stealing cookies, performing actions on behalf of the victim, displaying fake content, or exfiltrating sensitive information. The attacker gains no server-side access but can fully compromise the victim's client-side session [2][4].

Mitigation

The fix was released in version 3.93v. The commit 8fdb4f67ac1a095331aa0fb4630ef9dfe8e75dcb adds the ng-non-bindable attribute to the anchor element, preventing AngularJS from evaluating expressions. Users should upgrade to 3.93v or later immediately. No workaround is available for earlier versions [3][4].