CVE-2025-12246
📋 TL;DR
This CVE describes a cross-site scripting (XSS) vulnerability in Chatwoot's admin interface that allows attackers to inject malicious scripts via manipulated Link parameters in the IframeLoader.vue component. The vulnerability affects Chatwoot installations up to version 4.7.0 and can be exploited remotely by attackers who can interact with the admin interface.
💻 Affected Systems
- Chatwoot
📦 What is this software?
Chatwoot by Chatwoot
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal admin session cookies, perform actions as administrators, deface the admin interface, or redirect users to malicious sites.
Likely Case
Attackers could perform session hijacking of admin accounts, leading to unauthorized access to customer data and chat management functions.
If Mitigated
With proper input validation and output encoding, the risk is limited to minor interface manipulation with no data compromise.
🎯 Exploit Status
Requires attacker to have access to manipulate admin interface parameters; no public exploit code available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 4.7.1 or later
Vendor Advisory: https://github.com/chatwoot/chatwoot/releases
Restart Required: No
Instructions:
1. Update Chatwoot to version 4.7.1 or later using your deployment method. 2. For Docker deployments: pull latest image and restart containers. 3. For manual installations: git pull from repository and rebuild assets.
🔧 Temporary Workarounds
Input Validation Enhancement
allImplement additional input validation for Link parameters in admin interface
Modify app/javascript/shared/components/IframeLoader.vue to sanitize Link parameter inputs
🧯 If You Can't Patch
- Restrict admin interface access to trusted IP addresses only
- Implement WAF rules to block XSS payloads in Link parameters
🔍 How to Verify
Check if Vulnerable:
Check Chatwoot version; if version is 4.7.0 or earlier, system is vulnerable.Check Version:
For Docker: docker exec chatwoot bundle exec rails -v | grep Chatwoot; For manual: cat /opt/chatwoot/.release-versionVerify Fix Applied:
Verify Chatwoot version is 4.7.1 or later and test admin interface Link parameter handling.📡 Detection & Monitoring
Log Indicators:
- Unusual admin interface access patterns
- Suspicious Link parameter values in admin logs
Network Indicators:
- Malformed URLs with script tags in admin interface requests
SIEM Query:
source="chatwoot" AND ("IframeLoader" OR "Link parameter") AND ("script" OR "javascript:" OR "onerror=")