Attack Chain

1. An attacker crafts a malicious HTML payload containing the oncontentvisibilityautostatechange= attribute with embedded JavaScript.
2. The attacker injects this payload into the body of an email template within the Novu workflow editor.
3. A user views the email template preview or receives an email generated from the compromised template.
4. The user's browser parses the HTML, including the unsanitized oncontentvisibilityautostatechange= attribute.
5. The JavaScript code embedded within the attribute executes in the user's browser, within the context of the Novu application.
6. The attacker can leverage the XSS to steal session cookies or inject malicious code into the Novu application.
7. The attacker can use the Google/GitHub OAuth flows without completing the code callback step, and send that URL to the victim.
8. By logging into the attacker's account, the prepared XSS payload is triggered.

Impact

Successful exploitation of this XSS vulnerability could allow an attacker to steal sensitive user data, including session cookies and API keys. An attacker can also perform actions on behalf of the victim, such as modifying workflow templates or sending malicious notifications. In scenarios where multiple users have access to the Novu dashboard, the impact can be amplified, leading to widespread compromise of user accounts and sensitive data. The vulnerability affects Novu versions prior to 3.15.0.

Recommendation

• Upgrade Novu to version 3.15.0 or later to patch the XSS vulnerability.
• Deploy the Sigma rule Detect Suspicious oncontentvisibilityautostatechange Attribute to your SIEM to detect attempts to exploit this vulnerability via crafted email templates.
• Regularly audit and review the sanitization mechanisms within your Novu application to ensure they are effective against new and emerging XSS attack vectors.