Libredesk is a self-hosted customer support desk. Prior to version 0.8.6-beta, LibreDesk is vulnerable to stored HTML injection in the contact notes feature. When adding notes via POST /api/v1/contacts/{id}/notes, the backend automatically wraps user input in <p> tags. However, by intercepting the request and removing the <p> tag, an attacker can inject arbitrary HTML elements such as forms and images, which are then stored and rendered without proper sanitization. This can lead to phishing, CSRF-style forced actions, and UI redress attacks. This issue has been patched in version 0.8.6-beta.

Affected: Go: github.com/abhinavxd/libredesk

### Summary

LibreDesk is vulnerable to **stored HTML injection** in the contact notes feature. When adding notes via `POST /api/v1/contacts/{id}/notes`, the backend automatically wraps user input in `<p>` tags. However, by intercepting the request and removing the `<p>` tag, an attacker can inject arbitrary HTML elements such as forms and images, which are then stored and rendered without proper sanitization. This can lead to phishing, CSRF-style forced actions, and UI redress attacks.

---

### Details

When notes are added through the LibreDesk web application, the client sends note content wrapped inside `<p>` tags. The backend appears to **trust this HTML structure** and stores the content as-is.

By intercepting the request to:

``` POST /api/v1/contacts/3/notes ```

and **removing the `<p>` wrapper**, an attacker can submit arbitrary HTML content. The backend does not sanitize or validate the HTML payload before persisting it.

As a result:

* Arbitrary HTML tags (e.g., `<form>`, `<input>`, `<img>`) are stored * The injected HTML is rendered when the notes are viewed in the application * No server-side HTML sanitization or allowlisting is enforced

This indicates that the application relies on **client-side HTML formatting assumptions**, which can be bypassed by modifying the request.

---

### PoC

1. Log in to LibreDesk and open any contact. 2. Add a note normally via the UI. 3. Intercept the request to:

``` POST /api/v1/contacts/3/notes ``` 4. Original re…