Description

This vulnerability impacts all fields sent to Chatwoot. Any field that has an excessive amount of characters in it will cause the agent's page to take an abnormal amount of time to load, often requiring the content to be removed before the page will load. In my example, I put 2000000000 characters in the name of the user and it caused my page not to load. Other examples could be the email, content of the message, etc. Chatwoot does not check for the length of strings or cut them down to an appropriate length.

Proof of Concept

window.$chatwoot.setUser("IDENTIFIER", { name: "hi".repeat(99999999999), identifier_hash: "HASH" })

You may need to play with the string length a bit as sometimes it will cause your Chrome tab to crash.

OR

Copy the result of "hi".repeat(1000000000) and paste it in the chatbox, then send the message.

Impact

This vulnerability is capable of making the entire agent panel not load for an extended period of time and causing the logs to output a very large amount of text. Chatwoot becomes basically unusable for any agents using the widget inbox and the user. I had to use the Chatwoot API to delete the message because I could not physically access the page anymore. After testing this for a little while of putting these long strings in, it seems I crashed my entire Docker instance and now my instance is broken. Oops!

It appears that if you spam it a few times (the setUser method), then you can crash the entire Chatwoot instance and make it become unresponsive to requests until it finishes processing all of the text that was sent.