Elevio Quality Management 9.7.0: Stored XSS via Dynamic Object Attribute Injection with POC

Vulnerability Overview Vulnerability Name: Elevio Quality Management 9.7.0 Conversation Events Creative Dynamic Object Property Determination Vulnerability Vulnerability Type: Cross-Site Scripting (XSS) CVSS Score: 6.1 (Medium) Affected Versions: Elevio Quality Management 9.7.0 and earlier Software Type: Conversation Management Tool Vulnerability Description: This vulnerability allows an attacker to inject arbitrary JavaScript code into the user interface by crafting malicious requests that dynamically create custom attributes via the property within . Attackers can exploit this to steal sensitive information, execute malicious operations, or disrupt system functionality. --- Scope of Impact Affected Products: Elevio Quality Management 9.7.0 and earlier Affected Components: property handling logic within the Conversation Events module Potential Risks: - Theft of sensitive data such as user session tokens and API keys - Execution of arbitrary JavaScript code (e.g., redirections, pop-ups, data exfiltration) - Disruption of frontend functionality or user experience --- Remediation 1. Upgrade Version: Immediately upgrade Elevio Quality Management to version 9.7.1 or higher (the vendor has patched this vulnerability). 2. Input Validation and Filtering: Implement strict whitelist validation for all attributes passed to , prohibiting dynamic attribute injection. 3. Output Encoding: Apply HTML entity encoding or enforce Content Security Policy (CSP) to restrict script execution when rendering user-controllable data. 4. Monitoring and Auditing: Review existing conversation event logs to identify any anomalous attribute injection activities. --- POC / Exploit Code Step 1: Craft Malicious Request (via Browser Developer Tools or curl) Step 2: Trigger the Vulnerability (View the event in the conversation interface) When a user opens a conversation containing the above event, the browser attempts to render the value of the property, causing the tag to execute. Step 3: Advanced Exploitation Example (Cookie Theft) Step 4: Execute Arbitrary JS via Dynamic Attributes > Note: performs Base64 decoding; in this case, it decodes to , which can be replaced with any malicious payload. --- Additional Notes This vulnerability can be triggered without authentication (if the conversation is public), though access to a specific conversation ID is typically required. Attackers may exploit this by forging conversation event IDs or hijacking legitimate sessions. It is recommended to deploy WAF rules to block requests containing characteristics such as , , or .

Goal Reached Thanks to every supporter — we hit 100%!

Elevio Quality Management 9.7.0: Stored XSS via Dynamic Object Attribute Injection with POC

More from this source