Security vulnerabilities found in a widely-used web analytics platform

Recent findings by Salt Security have highlighted a security vulnerability in Hotjar, a popular web analytics provider. Researchers discovered a cross-site scripting (XSS) flaw, particularly when combined with OAuth technology. OAuth is widely used in various web services, particularly for social logins.

Malicious actors can exploit this vulnerability by sending a legitimate-looking link to the target. This can be done through email, text message, or social media. Once the target clicks on the link, the malicious actor can take over the account, gaining access to sensitive data or performing unauthorized actions.

Hotjar, which gathers extensive data similar to Google Analytics, collects personal information, financial details, and private messages. With over a million websites using Hotjar, including major companies like Microsoft, these vulnerabilities could expose sensitive data on a massive scale.

Although the research focused on Hotjar, experts believe that the widespread use of OAuth and the prevalence of XSS vulnerabilities suggest that similar issues may exist in other web services as well.