eGain Chat version 15.5.5 suffers from a cross site scripting vulnerability.
8f713683de3e61e3153e8052e40aa17b# Exploit Title: eGain Chat 15.5.5 Cross-Site Scripting
# Vendor Homepage: https://www.egain.com/
# Software Link: https://www.egain.com/chat-software/
# Exploit Authors: Brandon Ming Yang Ho (https://www.linkedin.com/in/minhobrandon/), Hassy Vinod Eshan (https://www.linkedin.com/in/hassy-vinod/)
# CVE: CVE-2020-15948
# Timeline
- June 2020: Initial vulnerability discovery
- July 2020: Reported to eGain Corporation
- August 2020: Fix/patch provided by eGain Corporation
- September 2020: Public disclosure notified to eGain Corporation
- July 2021: Published CVE-2020-15948
# 1. Introduction
eGain Chat is a real time chat assistance solution by eGain Corporation for website visitors to communicate with chat agents.
# 2. Vulnerability Details
eGain Chat version 15.5.5 is vulnerable to reflected Cross-Site Scripting (Reflected XSS).
The “Name” input field (full_name) does not fully sanitise user input for special characters such as “<” or “>” and HTML attributes such as “<a href>”. It is possible for an attacker to bypass filtering and create malicious scripts. Once the response has been rendered, the malicious JavaScript code would be executed.
# 3. Proof of Concept
The “Name” input field (full_name) of the chat window can be injected with the following XSS payload as a Proof of Concept to execute a javascript alert popup.
Payload - <a href="javascript:alert(document.domain)">click</a>
# 4. Remediation
Apply the latest fix/patch from eGain Corporation.
# 5. Credits
- Brandon Ming Yang Ho (https://www.linkedin.com/in/minhobrandon/)
- Hassy Vinod Eshan (https://www.linkedin.com/in/hassy-vinod/)