CVE-2022-31455

Vulnerability

A stored cross-site scripting (XSS) vulnerability exists in Truedesk v1.2.2 [1]. The vulnerability is triggered when a user sends a specially crafted payload in a chat box message; the payload is not sanitized before being stored and later rendered to other users.

Exploitation

An attacker only needs to be able to send a message in the Truedesk chat box. No authentication or special privileges are required [1]. The attacker crafts a malicious script (e.g., ``) and sends it as a chat message. When other users view the chat, the script executes in their browsers.

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's browser. This can lead to session hijacking, defacement, or theft of sensitive information [1]. The scope of impact is the victim's interaction with Truedesk.

Mitigation

No official fix has been released for Truedesk v1.2.2 as of the publication date. Users should upgrade to a patched version if available, or apply input validation and output encoding as recommended in the reference [1]. Monitor for vendor updates.