Origin Validation Error in chatwoot/chatwoot
Reported on
Oct 17th 2021
Description
chatwoot failed to validate the original email when a user changing his/her email address in Profile Setting,
An attacker may use the mechanism to forge arbitrary email（especially in trusted domain）
Proof of Concept
my original email is：b2_account@iubridge.com, and I had confirmed it by clicking the according URL
But when i change my email to another address, i.e.no_existing_account@iubridge.com, it doesNOT require confirmation!
Impact
This vulnerability is capable of
- An attacker may use the mechanism to forge arbitrary email（especially in trusted domain）
- forging to be the staff from your offical sites, such as FOO@chatwoot.com
hello, is there anything I can do to speed up the confirmation?
@hi-uncle, Can you please share the steps you have done to update the email?
Original account:
- https://app.chatwoot.com/app/accounts/36817/dashboard
- aaaaaaaaaaa@iubridge.com, Note this Email has been confirmed
In https://app.chatwoot.com/app/accounts/36817/settings/agents/list, it shows that
Change email without validation
Firstly change it in the Account settings
Then login with the NEW email！
It shows MY fake mail is Verified!
An attacker could forge arbitrary email! such as TRUSTED fake_mail@chatwootmail.com in my example
https://app.chatwoot.com/app/accounts/36817/settings/agents/list
