A critical cross-site scripting vulnerability in the CleverTap Web SDK allows remote attackers to execute malicious scripts in the context of a user session.

The vulnerability exists in the handleCustomHtmlPreviewPostMessageEvent function, where insufficient origin validation using the includes method allows an attacker to bypass security checks via a crafted subdomain. This flaw permits unauthenticated remote attackers to trigger XSS through malicious postMessage events.

This vulnerability poses a significant risk to data integrity and user privacy. Successful exploitation could allow an attacker to hijack user sessions, steal sensitive session tokens, or perform actions on behalf of the user within the affected application. With a CVSS score of 8.3, this high-severity flaw requires immediate attention to prevent unauthorized access and potential data exfiltration.

Immediate Action: Update the CleverTap Web SDK to version 1.15.3 or later to incorporate the necessary origin validation fixes.

Proactive Monitoring: Review application logs for unusual postMessage activity or unexpected cross-origin interactions initiated from subdomains.

Compensating Controls: Implement a strict Content Security Policy (CSP) that restricts frame-ancestors and limits the domains allowed to interact with the application via postMessage to mitigate the impact of XSS.

Public Exploit Available: No

Given the potential for session hijacking and the existence of a proof-of-concept, organizations using the CleverTap Web SDK should prioritize patching this vulnerability. Upgrading to version 1.15.3 is the only definitive way to remediate the underlying logic error. Security teams should verify that all instances of the SDK are updated across their development and production environments immediately to maintain a secure posture.