-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability is a stored HTML injection where the Go backend fails to sanitize user-provided notes submitted to the /api/v1/contacts/{id}/notes endpoint. The backend stores the raw HTML, and the vulnerability is triggered when the frontend renders this content.
The provided patch focuses on mitigating the vulnerability on the client side by changing how the HTML content is rendered. The analysis of the patch identified several Vue.js components that were using v-dompurify-html to render content. This library was insufficient to prevent the injection of arbitrary HTML tags like <form>, as described in the PoC.
The patch replaces the usage of v-dompurify-html with a more restrictive component called <Letter>, which only allows a specific set of URL schemas, effectively preventing the malicious HTML from being rendered. The identified vulnerable functions are the Vue.js components where this insecure rendering occurred. While the root cause is the lack of input sanitization in the Go backend, the provided patch only contains changes for the frontend code, so the analysis is limited to the client-side components where the exploit would manifest in a user's browser.
ContactNotes.vuefrontend/src/features/contact/ContactNotes.vue
CommandBox.vuefrontend/src/features/command/CommandBox.vue
AgentMessageBubble.vuefrontend/src/features/conversation/message/AgentMessageBubble.vue
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/abhinavxd/libredesk | go | < 0.8.6-beta | 0.8.6-beta |
A Semantic Attack on Google Gemini - Read the Latest Research