Tara Hawkes, 23, was in shallow water near the vessel True North at Dugong Bay in the Kimberley region when the two-metre (6ft 6ins) crocodile bit her upper leg.
A passenger is believed to have pulled her to safety and she was flown by helicopter to the nearest hospital where she was in a stable condition on Monday night being treated for lacerations and puncture wounds.
Peter Trembath of North Star Cruises, the vessel's operator, said in a statement that the attack happened at a freshwater pool in only waist-deep water.
"Crew members checked the pool before entering the water. However, they did not detect the crocodile, which was estimated to be two metres in length," he said, adding that Hawkes worked as a crew member on the boat.
A Western Australia Department of Environment and Conservation spokesman said it had put out a warning to tourist operators not to let people swim in the area because it was believed the crocodile was still there.
True North, which can carry 36 passengers, was purpose-built to access remote wilderness areas with passengers paying as much as Aus$13,995 (US$14,500) a person for a seven-night Kimberley cruise.
Local reports said American model Jerry Hall, the former partner of Rolling Stone Mick Jagger, was a recent guest.
