A DOM-based Cross-Site Scripting vulnerability in the CleverTap Web SDK allows unauthenticated attackers to execute arbitrary scripts in the context of the user session.

The flaw resides in the Visual Builder module within the src/modules/visualBuilder/pageBuilder.js file, where origin validation is performed using an insecure includes() method. An unauthenticated attacker can bypass this check by crafting a malicious subdomain, leading to DOM-based Cross-Site Scripting.

Successful exploitation of this vulnerability allows an attacker to execute malicious JavaScript within the browser of an unsuspecting user. This can lead to session hijacking, unauthorized data access, or the performance of actions on behalf of the user, potentially compromising sensitive dashboard information. Given the CVSS score of 8.3, this high-severity flaw represents a significant risk to the integrity and confidentiality of the web application.

Immediate Action: Update the CleverTap Web SDK to version 1.15.3 or later immediately to incorporate the necessary origin validation fixes.

Proactive Monitoring: Review web application logs for suspicious postMessage events or unusual traffic patterns originating from unauthorized subdomains.

Compensating Controls: Implement a robust Content Security Policy (CSP) that restricts frame-ancestors and connect-src directives to trusted domains, which can mitigate the impact of XSS attacks.

Public Exploit Available: No (no weaponized exploit or public proof-of-concept repository identified).

Organizations utilizing the CleverTap Web SDK must prioritize upgrading to version 1.15.3 to address this security deficiency. Failure to patch allows for potential script injection attacks that could lead to full account takeover or sensitive data exposure. Given the availability of technical details regarding the bypass mechanism, prompt remediation is essential to maintain a secure posture.